@bridge_gpt/mcp-server 0.2.16 → 0.2.19

package/build/conductor/supervisor-config.js

@@ -2,15 +2,10 @@
  * Supervisor configuration resolution (BAPI-396, conductor C4).
  *
  * Centralizes the supervisor's wake cadence, global timeout, per-state stall
- * thresholds, liveness thresholds, escalation cooldown, and LLM budget caps.
- * All values are resolved from `process.env` with conservative, bounded defaults
- * following the style of {@link resolveConductorStoreConfig} in `store.ts`:
- * malformed values fall back to the default and excessive values are clamped.
- *
- * Token discipline: the WAKE cadence (frequent, deterministic event polling) is
- * intentionally separate from the LLM cadence (judgment-triggered only). The
- * deterministic loop runs every `wake_interval_ms`; the LLM is consulted at most
- * `llm_max_calls` times per run and only for ambiguous escalation candidates.
+ * thresholds, liveness thresholds, and escalation cooldown. All values are
+ * resolved from `process.env` with conservative, bounded defaults following the
+ * style of {@link resolveConductorStoreConfig} in `store.ts`: malformed values
+ * fall back to the default and excessive values are clamped.
  */
 const MINUTE_MS = 60_000;
 const HOUR_MS = 60 * MINUTE_MS;
@@ -36,13 +31,6 @@ const LIVENESS_STALLED_AFTER_MAX_MS = 4 * HOUR_MS;
 const DEAD_AFTER_DEFAULT_MS = 2 * HOUR_MS;
 const DEAD_AFTER_MIN_MS = 10 * MINUTE_MS;
 const DEAD_AFTER_MAX_MS = 24 * HOUR_MS;
-// --- LLM budget. ----------------------------------------------------------
-const LLM_MAX_CALLS_DEFAULT = 10;
-const LLM_MAX_CALLS_MIN = 0;
-const LLM_MAX_CALLS_MAX = 1000;
-const LLM_TIMEOUT_DEFAULT_MS = 30_000;
-const LLM_TIMEOUT_MIN_MS = 1_000;
-const LLM_TIMEOUT_MAX_MS = 120_000;
 /**
  * Parse a bounded integer from an env-style string. Mirrors `parseBoundedInt`
  * in `store.ts`: blank/undefined/non-finite/float-with-fraction/non-numeric
@@ -68,19 +56,6 @@ export function parseBoundedSupervisorInt(raw, fallback, min, max) {
 const POLL_LIMIT_DEFAULT = 200;
 const POLL_LIMIT_MIN = 1;
 const POLL_LIMIT_MAX = 1000;
-/** Truthy parse for boolean-ish env strings (`0`/`false`/`off`/`no` => false). */
-function parseBoolEnv(raw, fallback) {
-    if (raw === undefined)
-        return fallback;
-    const v = raw.trim().toLowerCase();
-    if (v.length === 0)
-        return fallback;
-    if (v === "0" || v === "false" || v === "off" || v === "no")
-        return false;
-    if (v === "1" || v === "true" || v === "on" || v === "yes")
-        return true;
-    return fallback;
-}
 /**
  * Resolve the supervisor configuration. Precedence per field: a direct override
  * (when provided and valid) wins over the environment, which wins over the
@@ -96,13 +71,6 @@ export function resolveSupervisorConfig(overrides = {}, env = process.env) {
     const quiet_after_ms = parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_QUIET_AFTER_MS, QUIET_AFTER_DEFAULT_MS, QUIET_AFTER_MIN_MS, QUIET_AFTER_MAX_MS);
     const liveness_stalled_after_ms = parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_LIVENESS_STALLED_AFTER_MS, LIVENESS_STALLED_AFTER_DEFAULT_MS, LIVENESS_STALLED_AFTER_MIN_MS, LIVENESS_STALLED_AFTER_MAX_MS);
     const dead_after_ms = parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_DEAD_AFTER_MS, DEAD_AFTER_DEFAULT_MS, DEAD_AFTER_MIN_MS, DEAD_AFTER_MAX_MS);
-    // LLM is enabled by default but degrades cleanly. A direct `llm_enabled:false`
-    // override (e.g. CLI `--no-llm`) forces deterministic-only mode.
-    const llm_enabled = overrides.llm_enabled !== undefined
-        ? overrides.llm_enabled
-        : parseBoolEnv(env.BAPI_CONDUCTOR_LLM_ENABLED, true);
-    const llm_max_calls = clampOverride(overrides.llm_max_calls, parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_LLM_MAX_CALLS, LLM_MAX_CALLS_DEFAULT, LLM_MAX_CALLS_MIN, LLM_MAX_CALLS_MAX), LLM_MAX_CALLS_MIN, LLM_MAX_CALLS_MAX);
-    const llm_timeout_ms = clampOverride(overrides.llm_timeout_ms, parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_LLM_TIMEOUT_MS, LLM_TIMEOUT_DEFAULT_MS, LLM_TIMEOUT_MIN_MS, LLM_TIMEOUT_MAX_MS), LLM_TIMEOUT_MIN_MS, LLM_TIMEOUT_MAX_MS);
     const poll_limit = parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_SUPERVISOR_POLL_LIMIT, POLL_LIMIT_DEFAULT, POLL_LIMIT_MIN, POLL_LIMIT_MAX);
     return {
         wake_interval_ms,
@@ -114,9 +82,6 @@ export function resolveSupervisorConfig(overrides = {}, env = process.env) {
             dead_after_ms,
         },
         escalation_cooldown_ms,
-        llm_enabled,
-        llm_max_calls,
-        llm_timeout_ms,
         poll_limit,
     };
 }

package/build/conductor/supervisor-escalation.js

@@ -34,8 +34,7 @@ function elapsedSinceSignal(worker, now) {
  * Inspect run state and return deterministic escalation candidates. Reasons:
  * `worker_not_started`, `worker_stalled`, `worker_blocked`, `worker_dead`,
  * `candidate_done_stuck`, `verification_stalled`, and `global_timeout`. Terminal
- * workers never produce candidates. `ambiguous` marks candidates that benefit
- * from an LLM judgment (long-running stalls) vs. unambiguous ones.
+ * workers never produce candidates.
  */
 export function findSupervisorEscalationCandidates(state, config, now) {
     const candidates = [];
@@ -59,7 +58,6 @@ export function findSupervisorEscalationCandidates(state, config, now) {
                 state: worker.state,
                 liveness: worker.liveness,
                 elapsed_ms: elapsed,
-                ambiguous: false,
                 context: baseContext,
             });
             continue;
@@ -82,7 +80,6 @@ export function findSupervisorEscalationCandidates(state, config, now) {
                         state: worker.state,
                         liveness: worker.liveness,
                         elapsed_ms: elapsed,
-                        ambiguous: false,
                         context: baseContext,
                     });
                 }
@@ -95,7 +92,6 @@ export function findSupervisorEscalationCandidates(state, config, now) {
                     state: worker.state,
                     liveness: worker.liveness,
                     elapsed_ms: elapsed,
-                    ambiguous: false,
                     context: { ...baseContext, blocked_reason: worker.blocked_reason },
                 });
                 break;
@@ -107,7 +103,6 @@ export function findSupervisorEscalationCandidates(state, config, now) {
                     state: worker.state,
                     liveness: worker.liveness,
                     elapsed_ms: elapsed,
-                    ambiguous: true,
                     context: baseContext,
                 });
                 break;
@@ -124,7 +119,6 @@ export function findSupervisorEscalationCandidates(state, config, now) {
                         state: worker.state,
                         liveness: worker.liveness,
                         elapsed_ms: elapsed,
-                        ambiguous: true,
                         context: baseContext,
                     });
                 }
@@ -141,7 +135,6 @@ export function findSupervisorEscalationCandidates(state, config, now) {
                         state: worker.state,
                         liveness: worker.liveness,
                         elapsed_ms: elapsed,
-                        ambiguous: true,
                         context: baseContext,
                     });
                 }
@@ -160,7 +153,6 @@ export function findSupervisorEscalationCandidates(state, config, now) {
             state: null,
             liveness: null,
             elapsed_ms: Math.max(0, now - deadlineMs),
-            ambiguous: false,
             context: {
                 run_id: state.run_id,
                 deadline_at: state.global_deadline_at,
@@ -176,23 +168,20 @@ function cooldownWindowFor(now, cooldownMs) {
     return String(Math.floor(now / width));
 }
 /**
- * Decide whether a candidate should be emitted now. A candidate is SUPPRESSED
+ * Decide whether a candidate should be emitted now. A candidate is a DUPLICATE
  * when an escalation for the same worker + reason was already emitted (or hit a
  * duplicate) within the SAME cooldown window. Returns the cooldown window
  * identifier the caller must pass to `makeSupervisorIdempotencyKey` so the
- * idempotency key and the suppression check agree.
+ * idempotency key and the duplicate check agree.
  */
 export function shouldEmitEscalation(state, candidate, config, now) {
     const cooldownWindow = cooldownWindowFor(now, config.escalation_cooldown_ms);
     const alreadyDecided = state.escalations.some((record) => record.reason === candidate.reason &&
         (record.worker_id ?? null) === (candidate.worker_id ?? null) &&
         record.cooldown_window === cooldownWindow &&
-        // A prior emit/duplicate OR an explicit LLM "do not escalate" (suppressed)
-        // decision in this window is binding — do not re-decide (and, for ambiguous
-        // candidates, do not re-query the LLM) until the window rolls over.
-        (record.outcome === "emitted" ||
-            record.outcome === "duplicate" ||
-            record.outcome === "suppressed"));
+        // A prior emitted/duplicate decision in this window is binding — do not
+        // re-decide until the window rolls over.
+        (record.outcome === "emitted" || record.outcome === "duplicate"));
     return { emit: !alreadyDecided, cooldown_window: cooldownWindow };
 }
 /**
@@ -227,18 +216,13 @@ function formatElapsed(ms) {
 }
 /**
  * Render a concise, SECRET-FREE terminal escalation line. Includes run id,
- * worker id, reason, state, liveness, elapsed time, and optional LLM-drafted
- * text. Never includes raw payloads or full JSON dumps.
+ * worker id, reason, state, liveness, and elapsed time. Never includes raw
+ * payloads or full JSON dumps.
  */
-export function formatEscalationForTerminal(runId, candidate, draftText) {
+export function formatEscalationForTerminal(runId, candidate) {
     const worker = candidate.worker_id ? ` worker=${candidate.worker_id}` : "";
     const stateBit = candidate.state ? ` state=${candidate.state}` : "";
     const liveBit = candidate.liveness ? ` liveness=${candidate.liveness}` : "";
     const elapsed = ` elapsed=${formatElapsed(candidate.elapsed_ms)}`;
-    let line = `[supervisor] run=${runId}${worker} reason=${candidate.reason}${stateBit}${liveBit}${elapsed}`;
-    if (draftText && draftText.trim().length > 0) {
-        // Single-line the drafted text so the terminal stays scannable.
-        line += ` :: ${draftText.replace(/\s+/g, " ").trim()}`;
-    }
-    return line;
+    return `[supervisor] run=${runId}${worker} reason=${candidate.reason}${stateBit}${liveBit}${elapsed}`;
 }

package/build/conductor/supervisor-ledger.js

@@ -6,9 +6,8 @@
  * concurrent retries, each event carries a deterministic id derived from a
  * STABLE idempotency key. The key is built only from normalized dimensions
  * (run id, optional worker id, reason, kind, cooldown window) — it deliberately
- * EXCLUDES raw event payloads and any LLM free text, so two assessments with
- * different draft text but the same decision collide on the `events.id` UNIQUE
- * constraint instead of double-emitting.
+ * EXCLUDES raw event payloads, so two assessments for the same decision
+ * collide on the `events.id` UNIQUE constraint instead of double-emitting.
  *
  * This module performs NO privileged action: it only writes an audit event to
  * the local ledger.
@@ -22,7 +21,7 @@ function normalizeDimension(value) {
 /**
  * Build a stable idempotency key from normalized dimensions. Whitespace and
  * case are normalized; empty/undefined `worker_id` collapses to a fixed
- * run-level token. NO raw payload or LLM free text ever enters the key.
+ * run-level token. NO raw payload ever enters the key.
  */
 export function makeSupervisorIdempotencyKey(meta) {
     const parts = [
@@ -75,8 +74,7 @@ export async function emitSupervisorAssessmentIfNew(input, deps = {}) {
     const emitEvent = deps.emitEvent ?? emitConductorEvent;
     const idempotencyKey = makeSupervisorIdempotencyKey(input.idempotency);
     const eventId = makeSupervisorAssessmentEventId(idempotencyKey);
-    // Build secret-free assessment details. The assessment carries only the
-    // classification/decision and optional short drafted text — never raw payload.
+    // Build secret-free deterministic assessment details — never raw payload.
     const details = {
         ...(input.details ?? {}),
         idempotency_key: idempotencyKey,
@@ -85,12 +83,7 @@ export async function emitSupervisorAssessmentIfNew(input, deps = {}) {
         cooldown_window: input.idempotency.cooldown_window,
         classification: input.assessment.classification,
         confidence: input.assessment.confidence,
-        should_escalate: input.assessment.should_escalate,
-        assessment_source: input.assessment.source,
     };
-    if (input.assessment.draft_escalation_text) {
-        details.draft_escalation_text = input.assessment.draft_escalation_text;
-    }
     const event = {
         id: eventId,
         source: "conductor-supervisor",
@@ -101,7 +94,7 @@ export async function emitSupervisorAssessmentIfNew(input, deps = {}) {
         observed_via: "supervisor",
         data: {
             summary: `supervisor assessment: ${input.idempotency.reason}`,
-            status: input.assessment.should_escalate ? "escalated" : "noted",
+            status: "escalated",
             reason: input.idempotency.reason,
             details,
         },

package/build/conductor/supervisor-merge.js

@@ -1,9 +1,15 @@
 /**
  * Supervisor merge pipeline wrapper (Conductor C6, BAPI-398).
  *
- * Processes an eligible worker-scoped `gate.met` event by calling the API-owned
- * merge decision/execution endpoint and recording the returned `merge.*` ledger
- * events into the LOCAL conductor ledger. This module:
+ * Processes an eligible PR-bound `gate.met` event by calling the API-owned merge
+ * decision/execution endpoint and recording the returned `merge.*` ledger events
+ * into the LOCAL conductor ledger. The merge decision depends ONLY on the PR/gate
+ * identity `(repo, pr_number, head_sha, gate)` — `worker_id` is attribution
+ * metadata that is stamped onto the emitted `merge.*` events for audit but never
+ * gates the merge (BAPI-525 Change A). When the source `gate.met` lacks a
+ * `worker_id` (e.g. the autonomous git-hook chain), attribution is resolved from
+ * durable dispatch state via an optional `resolveWorkerIdForGateEvent` seam. This
+ * module:
  *
  *   - never performs a provider merge locally and never handles VCS write
  *     credentials (no `gh`, no GITHUB_TOKEN, no installation token, no shell-out),
@@ -52,6 +58,24 @@ function mapApiErrorReason(error) {
     }
     return "api_network";
 }
+/**
+ * Resolve the worker attribution stamped onto emitted `merge.*` ledger events for
+ * a `gate.met`. Precedence: (1) a non-empty `event.worker_id`, (2) the durable
+ * attribution seam, (3) `null`. Attribution is audit-only and is never required
+ * for the merge decision (BAPI-525 Change A).
+ */
+function resolveAttributionWorkerId(event, identity, resolve) {
+    if (typeof event.worker_id === "string" && event.worker_id.trim().length > 0) {
+        return event.worker_id.trim();
+    }
+    if (resolve) {
+        const resolved = resolve(event, identity);
+        if (typeof resolved === "string" && resolved.trim().length > 0) {
+            return resolved.trim();
+        }
+    }
+    return null;
+}
 /**
  * Process an eligible `gate.met` event end-to-end: terminal-success short-circuit,
  * API merge call, ordered ledger recording, and sanitized error handling. Never
@@ -68,6 +92,9 @@ export async function processGateMetMerge(access, event, deps = {}) {
         return { processed: false, reason: "ineligible" };
     }
     const actionKey = identity.action_key;
+    // Attribution only — resolved from the event or durable dispatch state, never a
+    // merge gate (BAPI-525 Change A). A null value is tolerated end-to-end.
+    const attributionWorkerId = resolveAttributionWorkerId(event, identity, deps.resolveWorkerIdForGateEvent);
     // Terminal-success short-circuit BEFORE any API call (idempotent across restart).
     if (await checkTerminal(actionKey)) {
         return { processed: false, reason: "already_succeeded" };
@@ -92,7 +119,7 @@ export async function processGateMetMerge(access, event, deps = {}) {
             reason,
             details: baseDetails,
             run_id: event.run_id ?? null,
-            worker_id: event.worker_id ?? null,
+            worker_id: attributionWorkerId,
             summary: `merge.failed ${reason}`,
         }, { emitEvent: deps.emitEvent });
         return { processed: true, outcome: "api_error", reason };
@@ -119,7 +146,7 @@ export async function processGateMetMerge(access, event, deps = {}) {
             reason: ledgerEvent.reason ?? null,
             details: ledgerEvent.details ?? baseDetails,
             run_id: event.run_id ?? null,
-            worker_id: event.worker_id ?? null,
+            worker_id: attributionWorkerId,
         }, { emitEvent: deps.emitEvent });
         emitted.push({ type: ledgerEvent.type, emitted: result.emitted });
     }

package/build/conductor/supervisor-message-relay.js

@@ -28,11 +28,8 @@ export function buildSupervisorEscalationWorkerMessage(candidate, assessment, st
         state: candidate.state,
         liveness: candidate.liveness,
         elapsed_ms: candidate.elapsed_ms,
-        assessment_source: assessment.source,
+        assessment_source: "deterministic",
     };
-    if (assessment.draft_escalation_text) {
-        details.draft_escalation_text = assessment.draft_escalation_text;
-    }
     return {
         run_id: state.run_id,
         worker_id: candidate.worker_id,
@@ -40,7 +37,7 @@ export function buildSupervisorEscalationWorkerMessage(candidate, assessment, st
         cause_seq: state.last_seq,
         payload: {
             summary: `supervisor escalation: ${candidate.reason}`,
-            status: assessment.should_escalate ? "escalated" : "noted",
+            status: "escalated",
             details,
         },
         source: "conductor-supervisor",

package/build/conductor/supervisor-notification.js

@@ -23,7 +23,7 @@ export async function dispatchSupervisorNotification(epicRunId, candidate, asses
             worker_id: candidate.worker_id ?? null,
             elapsed_ms: candidate.elapsed_ms,
             ticket_key: (candidate.context?.ticket_key ?? null),
-            draft_text: assessment.draft_escalation_text ?? null,
+            classification: assessment.classification,
         },
     };
     const headers = {

package/build/conductor/supervisor-runtime.js

@@ -12,13 +12,10 @@
  *   2. supervisor_projection — the resumable operational mirror (this loop owns
  *      writes; crash/restart re-hydrates from it).
  *   3. supervisor.assessment events — AUDIT ONLY; never override raw truth.
- *   4. LLM judgment context — DISPOSABLE; advisory text only, never persisted as
- *      truth and never able to execute an action.
  *
- * The deterministic loop owns correctness. The LLM is consulted only to classify
- * AMBIGUOUS stalls and draft escalation text, within a per-run budget, and
- * degrades to deterministic-only behavior whenever it is disabled, exhausted, or
- * fails.
+ * The deterministic loop owns correctness and always escalates a detected
+ * candidate (BAPI-496): there is no LLM judgment boundary and no suppression
+ * path.
  */
 import { waitForConductorEvent, getSupervisorSnapshot, upsertSupervisorProjection, sendWorkerMessage, } from "./store.js";
 import { emitSupervisorAssessmentIfNew } from "./supervisor-ledger.js";
@@ -26,36 +23,18 @@ import { sendSupervisorEscalationWorkerMessageIfNew } from "./supervisor-message
 import { resolveSupervisorConfig } from "./supervisor-config.js";
 import { hydrateSupervisorRunStateFromSnapshot, applyConductorEventToSupervisorState, applySupervisorHousekeeping, isSupervisorRunTerminal, hasSupervisorGlobalTimeoutElapsed, toSupervisorProjectionInput, } from "./supervisor-state.js";
 import { findSupervisorEscalationCandidates, shouldEmitEscalation, recordEscalationResult, formatEscalationForTerminal, } from "./supervisor-escalation.js";
-import { assessSupervisorCandidate } from "./supervisor-judgment.js";
 import { makeSupervisorIdempotencyKey } from "./supervisor-ledger.js";
-import { createDefaultSupervisorJudgmentClient } from "./supervisor-judgment-python.js";
 import { resolveConductorBridgeApiAccess, } from "./bridge-api-client.js";
 import { extractMergeActionIdentityFromGateEvent } from "./merge-ledger.js";
 import { processGateMetMerge } from "./supervisor-merge.js";
 import { dispatchSupervisorNotification } from "./supervisor-notification.js";
 import { ConductorValidationError } from "./errors.js";
-/** Compact, secret-free worker snapshot for the judgment request. */
-function compactWorkerForJudgment(worker) {
-    if (!worker)
-        return null;
-    return {
-        worker_id: worker.worker_id,
-        ticket_key: worker.ticket_key,
-        state: worker.state,
-        liveness: worker.liveness,
-        last_event_time: worker.last_event_time,
-        last_progress_time: worker.last_progress_time,
-    };
-}
-/** Deterministic (degraded) assessment for an unambiguous candidate. */
+/** Deterministic assessment for an escalation candidate. */
 function deterministicAssessment(candidate) {
     return {
         classification: "stuck",
         confidence: 1,
-        should_escalate: true,
         reason: candidate.reason,
-        draft_escalation_text: null,
-        source: "degraded",
     };
 }
 /** Resolve the terminal run status from worker outcomes. */
@@ -64,20 +43,20 @@ function terminalStatus(state) {
     return anyFailed ? "failed" : "complete";
 }
 /**
- * Process the escalation pipeline for the current state: find candidates, assess
- * ambiguous ones (within budget), emit idempotent assessment events, print
+ * Process the escalation pipeline for the current state: find candidates,
+ * deterministically assess them, emit idempotent assessment events, print
  * terminal lines for newly-emitted escalations, and record outcomes. Returns
  * nothing; it mutates `state`.
  */
-async function processEscalations(state, config, client, deps) {
+async function processEscalations(state, config, deps) {
     const now = deps.now();
     const candidates = findSupervisorEscalationCandidates(state, config, now);
     for (const candidate of candidates) {
         const decision = shouldEmitEscalation(state, candidate, config, now);
         if (!decision.emit)
             continue;
-        // Compute the idempotency key up front so EVERY decision in this window —
-        // including an LLM "do not escalate" — can be recorded under it.
+        // Compute the idempotency key up front so the decision in this window can
+        // be recorded under it.
         const idempotency = {
             run_id: state.run_id,
             worker_id: candidate.worker_id,
@@ -86,28 +65,8 @@ async function processEscalations(state, config, client, deps) {
             cooldown_window: decision.cooldown_window,
         };
         const idempotencyKey = makeSupervisorIdempotencyKey(idempotency);
-        let assessment;
-        if (candidate.ambiguous) {
-            assessment = await assessSupervisorCandidate({
-                run_id: state.run_id,
-                candidate,
-                worker: candidate.worker_id ? compactWorkerForJudgment(state.workers[candidate.worker_id]) : null,
-            }, config, state.llm_budget, client);
-        }
-        else {
-            assessment = deterministicAssessment(candidate);
-        }
+        const assessment = deterministicAssessment(candidate);
         state.latest_assessment = assessment;
-        if (!assessment.should_escalate) {
-            // The judgment declined to escalate. Record a `suppressed` decision for
-            // this cooldown window so the candidate is NOT re-judged every wake
-            // interval — without this, a persistently-ambiguous worker would re-query
-            // the LLM each tick, exhaust the per-run budget, and then escalate anyway
-            // once the degraded fallback kicks in. The decision stands until the
-            // window rolls over.
-            recordEscalationResult(state, candidate, decision.cooldown_window, idempotencyKey, "suppressed", now);
-            continue;
-        }
         let outcome = "skipped";
         try {
             const result = await deps.emitAssessment({
@@ -145,7 +104,7 @@ async function processEscalations(state, config, client, deps) {
         // Only print on a genuinely NEW escalation — never re-spam a duplicate after
         // a crash/restart within the same cooldown window.
         if (outcome === "emitted") {
-            deps.log(formatEscalationForTerminal(state.run_id, candidate, assessment.draft_escalation_text));
+            deps.log(formatEscalationForTerminal(state.run_id, candidate));
             // S7: dispatch an out-of-band human notification for newly emitted escalations.
             // Best-effort: a failure must never stop supervising.
             if (deps.dispatchNotification) {
@@ -179,7 +138,6 @@ export async function runSupervisor(options, deps = {}) {
     const upsertProjection = deps.upsertProjection ?? upsertSupervisorProjection;
     const emitAssessment = deps.emitAssessment ?? emitSupervisorAssessmentIfNew;
     const sendMessage = deps.sendWorkerMessage ?? sendWorkerMessage;
-    const judgmentClient = deps.judgmentClient ?? createDefaultSupervisorJudgmentClient(config);
     const resolveBridgeAccess = deps.resolveBridgeAccess ?? (() => resolveConductorBridgeApiAccess());
     const processMerge = deps.processMerge ?? processGateMetMerge;
     const dispatchNotification = deps.dispatchNotification ?? dispatchSupervisorNotification;
@@ -304,7 +262,7 @@ export async function runSupervisor(options, deps = {}) {
             // Housekeeping (liveness + state-specific stalls) runs every iteration so a
             // timeout with no events still advances liveness/stall state.
             applySupervisorHousekeeping(state, config, now());
-            await processEscalations(state, config, judgmentClient, {
+            await processEscalations(state, config, {
                 emitAssessment,
                 sendWorkerMessage: sendMessage,
                 log,

package/build/conductor/supervisor-state.js

@@ -48,11 +48,6 @@ export function createEmptySupervisorRunState(runId, config, now) {
         gates: {},
         latest_assessment: null,
         escalations: [],
-        llm_budget: {
-            enabled: config.llm_enabled,
-            max_calls: config.llm_max_calls,
-            used_calls: 0,
-        },
         started_at: startedIso,
         updated_at: startedIso,
         global_deadline_at: msToIso(now + config.global_timeout_ms),
@@ -93,15 +88,8 @@ export function hydrateSupervisorRunStateFromSnapshot(snapshot, runId, config, n
         escalations: Array.isArray(summary.escalations)
             ? summary.escalations
             : [],
-        llm_budget: summary.llm_budget && typeof summary.llm_budget === "object"
-            ? {
-                enabled: config.llm_enabled,
-                max_calls: config.llm_max_calls,
-                used_calls: typeof summary.llm_budget.used_calls === "number"
-                    ? summary.llm_budget.used_calls
-                    : 0,
-            }
-            : empty.llm_budget,
+        // A legacy pre-BAPI-496 LLM-budget summary key is intentionally ignored
+        // rather than treated as an error — old projections still carry it.
         started_at: typeof summary.started_at === "string" ? summary.started_at : empty.started_at,
         global_deadline_at: typeof summary.global_deadline_at === "string" ? summary.global_deadline_at : empty.global_deadline_at,
         roster_discovered: summary.roster_discovered === true,
@@ -536,11 +524,10 @@ function compactWorker(worker) {
  * holds compact worker summaries (never raw event data); `gates` holds gate
  * metadata; `assessment` holds the latest assessment or null; and `summary`
  * holds the FULL resumable supervisor state (worker watchdog states, liveness,
- * last seq, escalation history, LLM budget usage, run start/deadline metadata).
+ * last seq, escalation history, run start/deadline metadata).
  *
  * The serialized summary is secret-free by construction: it is built only from
- * the compact state fields above — never from raw payloads, secrets, or LLM
- * prompts.
+ * the compact state fields above — never from raw payloads or secrets.
  */
 export function toSupervisorProjectionInput(state) {
     const summary = {
@@ -553,7 +540,6 @@ export function toSupervisorProjectionInput(state) {
         gates: state.gates,
         latest_assessment: state.latest_assessment,
         escalations: state.escalations,
-        llm_budget: state.llm_budget,
         started_at: state.started_at,
         updated_at: state.updated_at,
         global_deadline_at: state.global_deadline_at,

package/build/conductor/supervisor-types.js

@@ -3,8 +3,8 @@
  * (BAPI-396, conductor C4).
  *
  * These are pure TypeScript type declarations with NO runtime behavior so every
- * supervisor module (config, reducer, escalation, judgment, runtime) can depend
- * on them freely without import cycles or side effects.
+ * supervisor module (config, reducer, escalation, runtime) can depend on them
+ * freely without import cycles or side effects.
  *
  * Vocabulary split — the supervisor tracks two ORTHOGONAL axes per worker:
  *   - {@link WatchdogState}: the worker's progress through the run lifecycle

package/build/conductor/taxonomy.js

@@ -34,6 +34,10 @@ export const SEMANTIC_EVENT_TYPES = [
     "merge.attempted",
     "merge.succeeded",
     "merge.failed",
+    // BAPI-494: a PR that cannot be merged (CONFLICTING/DIRTY). A terminal,
+    // head-scoped blocking signal that folds to `blocked` and routes through the
+    // BAPI-441 remediation pass as a resume-mode redispatch.
+    "merge.conflict",
     "merge.pending_approval",
     // BAPI-440 PR review-state telemetry event types.
     "review.passed",
@@ -47,6 +51,14 @@ export const SEMANTIC_EVENT_TYPES = [
     // post-merge repository re-index, so the (stateless) reconcile loop can fold a
     // merged ticket to `done` from the ledger instead of an in-memory wait map.
     "parse.triggered",
+    // BAPI-527: durable parse-after-merge TERMINAL markers. Emitted by epic-tick
+    // once the durable `/jira/parse-status` surface reports a terminal outcome for a
+    // triggered post-merge parse: `parse.succeeded` lets the merge.succeeded signal
+    // proceed to `done`; `parse.failed` folds the ticket to `blocked` (and escalates).
+    // Payloads are compact (summary/status/reason/details with epic_key + ticket_key
+    // + bounded parse error metadata) — never subprocess stdout/stderr/stacks/commands.
+    "parse.succeeded",
+    "parse.failed",
 ];
 /**
  * Type guard: returns `true` only when `value` is one of the exact taxonomy

package/build/conductor/tools.js

@@ -11,9 +11,14 @@
 import { z } from "zod";
 import { SEMANTIC_EVENT_TYPES } from "./taxonomy.js";
 import { ConductorValidationError, toConductorErrorEnvelope } from "./errors.js";
-import { emitConductorEvent, pollConductorEvents, waitForConductorEvent, getSupervisorSnapshot, sendWorkerMessage, checkWorkerMessages, } from "./store.js";
+import { emitConductorEvent, pollConductorEvents, waitForConductorEvent, getSupervisorSnapshot, sendWorkerMessage, } from "./store.js";
 import { normalizePrNumber, normalizeSha } from "./git-ci-types.js";
 import { waitForDoneGate, resolveDispatchRunIdForBinding } from "./pr-ci-producer.js";
+// BAPI-527: worker-facing ledger operations run through the conductor CLI
+// subprocess (under the captured conductor Node), NOT the in-process SQLite store,
+// so the worker Node never loads the `better-sqlite3` native binary. `store.ts`'s
+// `checkWorkerMessages` is intentionally NOT imported here anymore.
+import { checkWorkerMessagesViaCli, emitConductorEventIfNewViaCli } from "./worker-ledger-cli.js";
 import { resolveConductorBridgeApiAccess, fetchEpicRunState, ConductorBridgeApiError } from "./bridge-api-client.js";
 /** Build a Zod enum from the semantic taxonomy so arbitrary types are rejected up front. */
 export function buildEventTypeZodEnum() {
@@ -37,7 +42,10 @@ function jsonResult(value) {
 /**
  * Wrap a tool handler so any thrown value becomes a sanitized structured JSON
  * error envelope (validation -> 400, store-busy -> 503, otherwise 500). Raw
- * input data, stack traces, and secret material are never echoed back.
+ * input data, stack traces, and secret material are never echoed back. Any
+ * allowlisted structured `details` on the envelope (e.g. the BAPI-526
+ * LEDGER_NATIVE_MODULE_LOAD_FAILED node_version/ABI/module fields) is preserved
+ * through {@link jsonResult}'s pretty serialization unchanged.
  */
 export function withConductorToolErrorHandling(handler) {
     return async (args) => {
@@ -249,7 +257,17 @@ function registerWaitForDoneGateTool(registerTool) {
             timeoutMs: args.timeout_ms,
             pollIntervalMs: args.poll_interval_ms,
             worktreePath: args.worktree_path,
-        }, { resolveRunId: resolveDispatchRunIdForBinding });
+        }, {
+            resolveRunId: resolveDispatchRunIdForBinding,
+            // BAPI-527: route the gate's ENTIRE dedup+emit through the conductor CLI
+            // subprocess. Injecting `emitIfNew` (not just the write sink) replaces the
+            // in-process `emitConductorEventIfNew`, whose `eventAlreadyExists` poll
+            // pre-check would load better-sqlite3 in the worker Node. The dedupe key +
+            // deterministic id are derived purely and the id is forwarded to the CLI,
+            // so dedup happens server-side on the events.id UNIQUE constraint — the
+            // worker path performs NO in-process ledger read or write.
+            emitIfNew: (input, dimensions) => emitConductorEventIfNewViaCli(input, dimensions),
+        });
         return jsonResult({
             gate_met: result.gate_met,
             timed_out: result.timed_out,
@@ -338,9 +356,13 @@ function registerCheckMessagesTool(registerTool) {
         if (runId.trim().length === 0 || workerId.trim().length === 0) {
             throw new ConductorValidationError("Conductor worker identity is unavailable: provide run_id + worker_id, or set BAPI_CONDUCTOR_RUN_ID and BAPI_CONDUCTOR_WORKER_ID.");
         }
-        const result = await checkWorkerMessages({
-            run_id: runId,
-            worker_id: workerId,
+        // BAPI-527: read+ack through the conductor CLI subprocess (captured
+        // conductor Node), NOT the in-process store, so the worker Node never loads
+        // better-sqlite3. A missing/invalid CONDUCTOR_NODE_PATH surfaces as the
+        // typed LEDGER_SUBPROCESS_RUNTIME_UNAVAILABLE envelope via the wrapper below.
+        const result = await checkWorkerMessagesViaCli({
+            runId,
+            workerId,
             limit: args.limit,
         });
         return jsonResult(result);