@bridge_gpt/mcp-server 0.2.18 → 0.2.19

package/build/conductor/errors.js

@@ -61,6 +61,76 @@ export class ConductorStoreError extends Error {
         this.name = "ConductorStoreError";
     }
 }
+/**
+ * Raised when the frozen v1 `conductor epic-tick` entrypoint is invoked
+ * (BAPI-534, Epic Conductor v2 slice 0). The v1 local reconciler/ledger tick is
+ * frozen: Epic Conductor v2 replaces it with a server-side reconciler plus the
+ * local executor (`mcp-server executor`). The message points operators at the v2
+ * path and is path-free / secret-free.
+ */
+export class ConductorEpicTickV1FrozenError extends Error {
+    constructor() {
+        super("The v1 `conductor epic-tick` path is frozen (EPIC_TICK_V1_FROZEN). Epic " +
+            "Conductor v2 replaces the local epic tick with a server-side reconciler " +
+            "plus the local executor — run `mcp-server executor` instead.");
+        this.name = "ConductorEpicTickV1FrozenError";
+    }
+}
+/**
+ * Raised (BAPI-527) when the worker-side ledger subprocess boundary cannot run.
+ *
+ * Worker-facing ledger operations (`check_messages`, `wait_for_done_gate` event
+ * emission) MUST execute through `conductor-bin.js` under the captured conductor
+ * Node (`CONDUCTOR_NODE_PATH`) so the worker Node never loads the `better-sqlite3`
+ * native binary. When that runtime is missing or invalid, this error makes the
+ * failure LOUD and structured rather than silently falling back to the worker
+ * Node. The carried `reason`/`envVar` are the ONLY diagnostic surface — both are
+ * fixed, non-secret, path-free tokens. No caught error, path, argv, stdout,
+ * stderr, or credential value is ever attached.
+ */
+export class ConductorLedgerSubprocessRuntimeError extends Error {
+    reason;
+    envVar;
+    constructor(reason, envVar) {
+        // Single-line, path-free, secret-free (the committed CLI-stderr invariant in
+        // security-regressions.test.ts requires it). Names only the reason token.
+        super(`Conductor worker ledger subprocess is unavailable (reason: ${reason}).`);
+        this.name = "ConductorLedgerSubprocessRuntimeError";
+        this.reason = reason;
+        this.envVar = envVar;
+    }
+}
+/**
+ * Structural guard for a native-module-load failure raised by the conductor
+ * store (BAPI-526). Detected structurally (by `name` + a valid `details` object)
+ * rather than by importing `ConductorNativeModuleLoadError` from `store.ts`, so
+ * `errors.ts` avoids a runtime import cycle with the store.
+ */
+export function isConductorNativeModuleLoadError(error) {
+    if (!(error instanceof Error))
+        return false;
+    if (error.name !== "ConductorNativeModuleLoadError")
+        return false;
+    const details = error.details;
+    if (!details || typeof details !== "object" || Array.isArray(details))
+        return false;
+    const d = details;
+    return (typeof d.node_version === "string" &&
+        typeof d.node_modules_abi === "string" &&
+        typeof d.module === "string");
+}
+/**
+ * Copy ONLY the three allowlisted native-load detail fields. Never spreads
+ * arbitrary properties from the error, so a secret/path smuggled onto the error
+ * object cannot round-trip into the client envelope.
+ */
+function nativeModuleDetailsEnvelope(details) {
+    return {
+        node_version: details.node_version,
+        node_modules_abi: details.node_modules_abi,
+        module: details.module,
+    };
+}
 /**
  * Heuristically detect SQLite busy/locked failures so they can be surfaced as a
  * retryable 503 rather than an opaque 500. Matches the `better-sqlite3` error
@@ -101,11 +171,37 @@ function isSqliteBusyError(error) {
  *     the raw error text, stack, and any secret material are discarded.
  */
 export function toConductorErrorEnvelope(error) {
+    // v1 epic-tick freeze (BAPI-534): the frozen entrypoint maps to a stable,
+    // named 400 pointing operators at Epic Conductor v2 (server-side reconciler +
+    // local executor). Checked first — it is a fail-loud guard, not a runtime fault.
+    if (error instanceof ConductorEpicTickV1FrozenError) {
+        return {
+            error: "EPIC_TICK_V1_FROZEN",
+            status: 400,
+            message: error.message,
+        };
+    }
+    // Native-module LOAD failure (BAPI-526): `better-sqlite3` is present but fails
+    // to load for this Node runtime (ABI/dlopen mismatch). Checked BEFORE the
+    // generic persistence-unavailable branch below (the native-load error subclasses
+    // it) so an ABI/dlopen failure surfaces as a distinct, machine-readable kind
+    // carrying node_version/ABI — never masked as INTERNAL_ERROR or the
+    // undifferentiated PERSISTENCE_UNAVAILABLE. `details` is a fixed three-field
+    // allowlist copied explicitly, never spread from the error object.
+    if (isConductorNativeModuleLoadError(error)) {
+        return {
+            error: "LEDGER_NATIVE_MODULE_LOAD_FAILED",
+            status: 500,
+            message: "Conductor ledger native module failed to load for this Node runtime.",
+            details: nativeModuleDetailsEnvelope(error.details),
+        };
+    }
     // Optional-native-binding degradation (BAPI-451): the conductor `store.ts`
     // throws ConductorPersistenceUnavailableError when `better-sqlite3` could not be
-    // loaded. Detected by name (not instanceof) to avoid an import cycle with
-    // store.ts. Surfaced as a retryable-shaped 503 with a fixed, secret-free message
-    // so the caller learns persistence is unavailable instead of getting an opaque 500.
+    // loaded (or is not installed). Detected by name (not instanceof) to avoid an
+    // import cycle with store.ts. Surfaced as a retryable-shaped 503 with a fixed,
+    // secret-free message so the caller learns persistence is unavailable instead of
+    // getting an opaque 500.
     if (error instanceof Error && error.name === "ConductorPersistenceUnavailableError") {
         return {
             error: "PERSISTENCE_UNAVAILABLE",
@@ -113,6 +209,22 @@ export function toConductorErrorEnvelope(error) {
             message: "Conductor persistence is unavailable (the optional better-sqlite3 native module is not loaded). Conductor coordination features are disabled; core tools are unaffected.",
         };
     }
+    // Worker-ledger subprocess runtime failure (BAPI-527): CONDUCTOR_NODE_PATH /
+    // BAPI_CONDUCTOR_CLI_FILE is missing or invalid so the worker cannot reach the
+    // local ledger through the captured conductor Node. Surfaced as a retryable-
+    // shaped 503 with a fixed, secret-free message plus a small non-secret details
+    // bag (env_var + stable reason). NOTHING path/secret-bearing is echoed. This is
+    // distinct from LEDGER_NATIVE_MODULE_LOAD_FAILED / PERSISTENCE_UNAVAILABLE,
+    // which cover conductor-owned processes that still load better-sqlite3 directly.
+    if (error instanceof ConductorLedgerSubprocessRuntimeError) {
+        return {
+            error: "LEDGER_SUBPROCESS_RUNTIME_UNAVAILABLE",
+            status: 503,
+            message: "Conductor worker ledger subprocess is unavailable; the worker Node cannot reach the local ledger. " +
+                "The dispatched conductor Node runtime is missing or invalid — conductor worker coordination is degraded; core tools are unaffected.",
+            details: { env_var: error.envVar, reason: error.reason },
+        };
+    }
     if (error instanceof ConductorValidationError) {
         // Validation messages are conductor-authored and name the offending field,
         // never its value — but redact defensively so an adversarial/secret-bearing

package/build/conductor/event-accessors.js

@@ -161,6 +161,9 @@ const EVENT_PARSERS = {
     "spec_review.passed": parseSpecReview,
     "spec_review.changes_requested": parseSpecReview,
     "parse.triggered": parseEmpty,
+    // BAPI-527: parse-after-merge terminal markers (details-less typed payload).
+    "parse.succeeded": parseEmpty,
+    "parse.failed": parseEmpty,
 };
 // ---------------------------------------------------------------------------
 // Public accessors
@@ -193,20 +196,35 @@ export function getHeadSha(event) {
     return normalizeEventHeadSha(details.head_sha);
 }
 /**
- * Resolve the immutable {@link MergeActionIdentity} from a worker-scoped `gate.met`
- * event. Returns `null` unless the event is a `gate.met` carrying a complete PR
- * binding (repo, pr_number, head_sha, gate_name) and a non-empty `worker_id`.
- * Run-level or incomplete events yield `null`. Preserves the historical
- * `required_checks` dual path (top-level then nested `ci_check_status`) and never
- * throws. Branch-name fields, if present, are ignored.
+ * Read and normalize a PR number from the CANONICAL `event.data.details.pr_number`
+ * path only (BAPI-525). Returns a positive integer PR number or `null` for
+ * missing/non-object details or a malformed value. Fail-closed. Used by the
+ * dispatched-backstop's local-first PR binding resolver to bind a ticket's PR from
+ * ledger events (e.g. `gate.met`) that carry both `pr_number` and `head_sha`,
+ * before falling back to a `gh` lookup.
+ */
+export function getPrNumber(event) {
+    const details = getRawEventDetails(event);
+    if (!details)
+        return null;
+    return normalizePrNumber(details.pr_number);
+}
+/**
+ * Resolve the immutable {@link MergeActionIdentity} from a PR-bound `gate.met`
+ * event. The true merge identity is `(repo, pr_number, head_sha, gate_name)`;
+ * `worker_id` is attribution metadata only and is NOT required for identity
+ * extraction (BAPI-525 Change A). Returns `null` unless the event is a `gate.met`
+ * carrying a complete PR binding (repo, pr_number, head_sha, gate_name) — an
+ * incomplete PR binding remains fail-closed regardless of `worker_id`. A
+ * worker_id-less `gate.met` produced by the autonomous git-hook chain therefore
+ * yields the SAME non-null identity (and byte-identical `action_key`) as its
+ * worker-stamped twin. Preserves the historical `required_checks` dual path
+ * (top-level then nested `ci_check_status`) and never throws. Branch-name fields,
+ * if present, are ignored.
  */
 export function getMergeIdentity(event) {
     if (event.type !== "gate.met")
         return null;
-    // Worker scope is required — a run-level gate.met never binds a specific worker.
-    if (typeof event.worker_id !== "string" || event.worker_id.trim().length === 0) {
-        return null;
-    }
     const details = getEventDetails(event, "gate.met");
     if (details === null)
         return null;

package/build/conductor/merge-ledger.js

@@ -25,10 +25,12 @@ import { emitConductorEvent, openReadonlyConductorDatabaseIfExists, } from "./st
 // existing importers (`supervisor-merge.ts`, tests) keep a stable API surface.
 export { buildGateIdentity, makeMergeActionKey };
 /**
- * Resolve the immutable merge identity from a `gate.met` event. Returns `null`
- * unless the event is a worker-scoped `gate.met` carrying a complete PR binding
- * (repo, pr_number, head_sha, gate_name). Run-level or incomplete events yield
- * `null`. Branch-name fields, if present, are ignored.
+ * Resolve the immutable merge identity from a `gate.met` event. Returns a non-null
+ * identity for any complete PR-bound `gate.met` (repo, pr_number, head_sha,
+ * gate_name), regardless of worker attribution — `worker_id` is attribution
+ * metadata only and is not required for merge identity extraction (BAPI-525
+ * Change A). Incomplete PR bindings remain fail-closed and yield `null`.
+ * Branch-name fields, if present, are ignored.
  *
  * BAPI-493: canonical parsing now lives in the typed accessor layer — this is a
  * thin compatibility wrapper over {@link getMergeIdentity} so `supervisor-merge.ts`

package/build/conductor/pr-ci-producer.js

@@ -23,6 +23,11 @@ async function _fetchGateConfigDefault(access) {
 }
 import { resolvePrHeadBinding } from "./pr-discovery.js";
 import { emitConductorEventIfNew } from "./producer-ledger.js";
+// In-process ledger writer — the DEFAULT emit sink for conductor-OWNED paths
+// (the CLI/supervisor/epic runtimes that legitimately own the better-sqlite3
+// load). The worker `wait_for_done_gate` MCP path injects a CLI-subprocess emitter
+// instead (BAPI-527) so the worker Node never loads the native binary.
+import { emitConductorEvent as emitConductorEventInProcess } from "./store.js";
 const PRODUCER_OBSERVED_VIA = "pr-ci-producer";
 /** Bounded wait constants, consistent with the existing wait_for_event pattern. */
 export const WAIT_FOR_GATE_TIMEOUT_MAX_MS = 120_000;
@@ -124,7 +129,15 @@ function defaultSleep(ms) {
  * resolved exactly once by the caller.
  */
 async function observeWithResolved(binding, access, gateConfig, deps) {
-    const emitIfNew = deps.emitIfNew ?? emitConductorEventIfNew;
+    // The event-WRITE sink defaults to the in-process store; the worker gate path
+    // injects a CLI-subprocess emitter (BAPI-527). When a caller supplies its own
+    // `emitIfNew` (e.g. unit tests / conductor-owned callers), that fully overrides
+    // this and the injected write sink is not consulted.
+    const emitConductorEventFn = deps.emitConductorEvent ?? emitConductorEventInProcess;
+    const emitIfNew = deps.emitIfNew ??
+        ((input, dimensions) => emitConductorEventIfNew(input, dimensions, {
+            emitEvent: emitConductorEventFn,
+        }));
     const pollCi = deps.pollCi ?? pollCiChecksForCommit;
     const now = deps.now ?? (() => new Date().toISOString());
     // Resolve run_id/worker_id for attribution. Env takes precedence; fall back
@@ -193,7 +206,9 @@ async function observeWithResolved(binding, access, gateConfig, deps) {
     let reviewSnapshot = null;
     try {
         const reviewObservation = await observeReviewWithResolved(binding, access, gateConfig, {
-            emitIfNew: deps.emitIfNew ?? emitConductorEventIfNew,
+            // Reuse the resolved `emitIfNew` so review-state events emitted alongside CI
+            // route through the SAME (possibly CLI-subprocess) write sink (BAPI-527).
+            emitIfNew,
             env: deps.env,
         });
         reviewSnapshot = reviewObservation.snapshot;

package/build/conductor/producer-ledger.js

@@ -37,7 +37,7 @@ export function makeStableProducerEventId(dedupeKey) {
     return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }
 /** Heuristically detect a SQLite duplicate-id / UNIQUE constraint failure. */
-function isDuplicateConstraintError(error) {
+export function isDuplicateConstraintError(error) {
     if (!error || typeof error !== "object")
         return false;
     const code = error.code;

package/build/conductor/store.js

@@ -38,6 +38,68 @@ export class ConductorPersistenceUnavailableError extends Error {
         this.name = "ConductorPersistenceUnavailableError";
     }
 }
+/** The native module whose load status this store owns. */
+const LEDGER_NATIVE_MODULE_NAME = "better-sqlite3";
+/**
+ * Thrown when `better-sqlite3` is present but fails to LOAD for this Node runtime
+ * (ABI/`NODE_MODULE_VERSION` mismatch or a generic `dlopen` failure) — distinct
+ * from "module simply not installed", which stays on the base
+ * {@link ConductorPersistenceUnavailableError} (503) path. Subclassing the base
+ * keeps existing `instanceof`/name-based degradation working while carrying the
+ * structured, secret-free {@link ConductorNativeModuleLoadDetails}. The raw
+ * caught error, stack, path, and message are deliberately NOT stored on the
+ * public instance.
+ */
+export class ConductorNativeModuleLoadError extends ConductorPersistenceUnavailableError {
+    details;
+    failureKind;
+    constructor(failureKind, details) {
+        super("Conductor ledger native module failed to load for this Node runtime.");
+        this.name = "ConductorNativeModuleLoadError";
+        this.failureKind = failureKind;
+        this.details = details;
+    }
+}
+/** Build the allowlisted runtime details for the CURRENT process. */
+export function buildNativeModuleLoadDetails() {
+    return {
+        node_version: process.version,
+        node_modules_abi: process.versions.modules ?? "unknown",
+        module: LEDGER_NATIVE_MODULE_NAME,
+    };
+}
+/**
+ * Classify a caught `better-sqlite3` load failure. Inspects ONLY the error `code`
+ * and `message` locally; the raw text never leaves this helper.
+ *
+ *   - `MODULE_NOT_FOUND` / `ERR_MODULE_NOT_FOUND` -> base
+ *     {@link ConductorPersistenceUnavailableError} ("not installed", 503).
+ *   - `NODE_MODULE_VERSION` / "compiled against a different Node.js version" /
+ *     "module version mismatch" -> native-load `abi_mismatch`.
+ *   - `ERR_DLOPEN_FAILED` / generic `dlopen` -> native-load `dlopen_failed`.
+ *   - Anything else -> base {@link ConductorPersistenceUnavailableError}.
+ */
+export function classifyDatabaseModuleLoadFailure(error) {
+    const code = error && typeof error === "object" ? error.code : undefined;
+    const rawMessage = error && typeof error === "object" && typeof error.message === "string"
+        ? (error.message)
+        : "";
+    const lowered = rawMessage.toLowerCase();
+    if (code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND") {
+        return new ConductorPersistenceUnavailableError();
+    }
+    const isAbiMismatch = lowered.includes("node_module_version") ||
+        lowered.includes("compiled against a different node.js version") ||
+        lowered.includes("module version mismatch");
+    if (isAbiMismatch) {
+        return new ConductorNativeModuleLoadError("abi_mismatch", buildNativeModuleLoadDetails());
+    }
+    const isDlopen = code === "ERR_DLOPEN_FAILED" || lowered.includes("dlopen");
+    if (isDlopen) {
+        return new ConductorNativeModuleLoadError("dlopen_failed", buildNativeModuleLoadDetails());
+    }
+    return new ConductorPersistenceUnavailableError();
+}
 /**
  * Cached, concurrency-safe async loader for the optional `better-sqlite3` module.
  *
@@ -50,13 +112,21 @@ export class ConductorPersistenceUnavailableError extends Error {
  * warning is emitted exactly once and every subsequent call throws
  * {@link ConductorPersistenceUnavailableError} immediately, without re-attempting the
  * failing import on every Conductor operation.
+ *
+ * BAPI-526: the caught error is CLASSIFIED (not swallowed) into a TYPED failure —
+ * ABI/dlopen mismatches become {@link ConductorNativeModuleLoadError} carrying
+ * `node_version`/`node_modules_abi`, while "module not installed" stays the base
+ * {@link ConductorPersistenceUnavailableError}. That typed failure is cached and
+ * re-thrown on every later call so the classification is never lost.
  */
 let databaseModulePromise = null;
-let dbLoadDegraded = false;
+let dbLoadFailure = null;
+let dbLoadDiagnosticEmitted = false;
 async function getDatabaseModule() {
-    // Cached degraded state: never re-attempt a known-failing native import.
-    if (dbLoadDegraded) {
-        throw new ConductorPersistenceUnavailableError();
+    // Cached typed failure: never re-attempt a known-failing native import, and
+    // preserve the ABI/dlopen classification across every subsequent call.
+    if (dbLoadFailure) {
+        throw dbLoadFailure;
     }
     if (databaseModulePromise)
         return databaseModulePromise;
@@ -67,13 +137,25 @@ async function getDatabaseModule() {
             const ctor = (mod.default ?? mod);
             return ctor;
         }
-        catch {
-            if (!dbLoadDegraded) {
-                dbLoadDegraded = true;
-                console.error("[conductor] Conductor persistence is unavailable: the optional 'better-sqlite3' native module could not be loaded. " +
+        catch (err) {
+            const classified = classifyDatabaseModuleLoadFailure(err);
+            dbLoadFailure = classified;
+            // Drop the rejected promise so the typed `dbLoadFailure` above is the sole
+            // cached state (the rejected promise itself must not be the only record).
+            databaseModulePromise = null;
+            if (!dbLoadDiagnosticEmitted) {
+                dbLoadDiagnosticEmitted = true;
+                // Fixed, path-free, secret-free diagnostic: module name, current Node
+                // version, current ABI, and coarse failure kind ONLY. Never the raw
+                // dlopen path, stack, or caught message.
+                const kind = classified instanceof ConductorNativeModuleLoadError
+                    ? classified.failureKind
+                    : "unavailable";
+                console.error(`[conductor] ${LEDGER_NATIVE_MODULE_NAME} native module could not be loaded ` +
+                    `(node=${process.version} abi=${process.versions.modules ?? "unknown"} kind=${kind}). ` +
                     "Conductor coordination features are disabled for this session; core MCP tools are unaffected.");
             }
-            throw new ConductorPersistenceUnavailableError();
+            throw classified;
         }
     })();
     return databaseModulePromise;
@@ -183,11 +265,15 @@ export function resolveConductorStoreConfig(env = process.env) {
  * CHECK vocabulary. Bumped to 7 because the durable parse-after-merge fold adds
  * the `parse.triggered` event type to the same `events.type` CHECK vocabulary
  * (replacing the in-memory parse-wait map so stateless epic-tick invocations can
- * fold a merged ticket to `done`). Older ledgers stamped at a lower version are
- * rebuilt by {@link migrateConductorSchemaIfNeeded} so their CHECK clause accepts
- * the current taxonomy.
+ * fold a merged ticket to `done`). Bumped to 8 in BAPI-527 because the durable
+ * parse-after-merge TERMINAL fold adds the `parse.succeeded` and `parse.failed`
+ * event types to the same `events.type` CHECK vocabulary (so the stateless
+ * epic-tick can fold a merged ticket to `done` on terminal parse success and
+ * `blocked` on permanent parse failure directly from the ledger). Older ledgers
+ * stamped at a lower version are rebuilt by {@link migrateConductorSchemaIfNeeded}
+ * so their CHECK clause accepts the current taxonomy.
  */
-export const CURRENT_CONDUCTOR_SCHEMA_VERSION = 7;
+export const CURRENT_CONDUCTOR_SCHEMA_VERSION = 8;
 /** Render the taxonomy `CHECK (type IN (...))` clause from the single source of truth. */
 function buildTypeCheckClause() {
     const list = SEMANTIC_EVENT_TYPES.map((t) => `'${t}'`).join(", ");
@@ -327,15 +413,15 @@ export function migrateConductorSchemaIfNeeded(db) {
         return;
     }
     const migrate = db.transaction(() => {
-        // Scratch table named for the current schema version (v4, BAPI-398) so the
-        // migration rebuild never reads as a stale pre-merge-taxonomy artifact.
-        db.exec(buildEventsTableSql("events_migrated_v5"));
-        db.exec(`INSERT INTO events_migrated_v5
+        // Scratch table named for the current schema version (v8, BAPI-527) so the
+        // migration rebuild never reads as a stale pre-parse-terminal-taxonomy artifact.
+        db.exec(buildEventsTableSql("events_migrated_v8"));
+        db.exec(`INSERT INTO events_migrated_v8
          (seq, id, source, type, subject, run_id, worker_id, producer, schema_version, time, data_json, confidence, observed_via, created_at)
        SELECT seq, id, source, type, subject, run_id, worker_id, producer, schema_version, time, data_json, confidence, observed_via, created_at
        FROM events`);
         db.exec("DROP TABLE events");
-        db.exec("ALTER TABLE events_migrated_v5 RENAME TO events");
+        db.exec("ALTER TABLE events_migrated_v8 RENAME TO events");
         db.exec(buildEventsIndexesSql());
         // Ensure auxiliary tables and their relay indexes exist on older ledgers too.
         db.exec(buildAuxiliaryTablesSql());
@@ -818,6 +904,56 @@ export async function upsertSupervisorProjection(input, config = resolveConducto
  * and network-home degradation. Never creates the DB, inserts a diagnostic
  * event, or mutates WAL/schema state.
  */
+/**
+ * Read-only probe of whether the ledger native binding actually loads for this
+ * Node runtime (BAPI-526). Reuses the lazy loader so it reflects the REAL load
+ * outcome, and NEVER opens the SQLite database, runs migrations, creates files,
+ * or emits events. On success reports `loads: true`; on a native-load failure
+ * reports the coarse `failure_kind` and marks the host degraded. All returned
+ * fields are secret-free and path-free.
+ */
+export async function inspectConductorLedgerNativeModuleLoad() {
+    const details = buildNativeModuleLoadDetails();
+    try {
+        await getDatabaseModule();
+        return {
+            module: details.module,
+            node_version: details.node_version,
+            node_modules_abi: details.node_modules_abi,
+            loads: true,
+            failure_kind: "none",
+            degraded: false,
+            warning: null,
+        };
+    }
+    catch (err) {
+        if (err instanceof ConductorNativeModuleLoadError) {
+            return {
+                ...err.details,
+                loads: false,
+                failure_kind: err.failureKind,
+                degraded: true,
+                warning: "better-sqlite3 failed to load for this Node runtime; conductor ledger operations are degraded.",
+            };
+        }
+        if (err instanceof ConductorPersistenceUnavailableError) {
+            return {
+                ...details,
+                loads: false,
+                failure_kind: "module_not_found",
+                degraded: true,
+                warning: "better-sqlite3 is not installed; conductor ledger operations are unavailable.",
+            };
+        }
+        return {
+            ...details,
+            loads: false,
+            failure_kind: "unknown",
+            degraded: true,
+            warning: "better-sqlite3 could not be loaded; conductor ledger operations are degraded.",
+        };
+    }
+}
 export async function doctorConductorLedger(config = resolveConductorStoreConfig()) {
     const health = getConductorPathHealth();
     const network = detectNetworkMountedHome();
@@ -825,6 +961,12 @@ export async function doctorConductorLedger(config = resolveConductorStoreConfig
     if (network.network_mounted && network.warning) {
         warnings.push(network.warning);
     }
+    // Read-only native-binding load probe (BAPI-526). Reflects the real lazy-loader
+    // outcome; never opens/creates/migrates the ledger.
+    const native_load = await inspectConductorLedgerNativeModuleLoad();
+    if (native_load.degraded && native_load.warning) {
+        warnings.push(native_load.warning);
+    }
     let schemaPresent = false;
     let journalMode = null;
     let eventCount = null;
@@ -873,6 +1015,7 @@ export async function doctorConductorLedger(config = resolveConductorStoreConfig
         message_relay: {
             message_cooldown_ms: config.message_cooldown_ms,
         },
+        native_load,
         degraded: network.network_mounted,
         warnings,
     };

package/build/conductor/supervisor-merge.js

@@ -1,9 +1,15 @@
 /**
  * Supervisor merge pipeline wrapper (Conductor C6, BAPI-398).
  *
- * Processes an eligible worker-scoped `gate.met` event by calling the API-owned
- * merge decision/execution endpoint and recording the returned `merge.*` ledger
- * events into the LOCAL conductor ledger. This module:
+ * Processes an eligible PR-bound `gate.met` event by calling the API-owned merge
+ * decision/execution endpoint and recording the returned `merge.*` ledger events
+ * into the LOCAL conductor ledger. The merge decision depends ONLY on the PR/gate
+ * identity `(repo, pr_number, head_sha, gate)` — `worker_id` is attribution
+ * metadata that is stamped onto the emitted `merge.*` events for audit but never
+ * gates the merge (BAPI-525 Change A). When the source `gate.met` lacks a
+ * `worker_id` (e.g. the autonomous git-hook chain), attribution is resolved from
+ * durable dispatch state via an optional `resolveWorkerIdForGateEvent` seam. This
+ * module:
  *
  *   - never performs a provider merge locally and never handles VCS write
  *     credentials (no `gh`, no GITHUB_TOKEN, no installation token, no shell-out),
@@ -52,6 +58,24 @@ function mapApiErrorReason(error) {
     }
     return "api_network";
 }
+/**
+ * Resolve the worker attribution stamped onto emitted `merge.*` ledger events for
+ * a `gate.met`. Precedence: (1) a non-empty `event.worker_id`, (2) the durable
+ * attribution seam, (3) `null`. Attribution is audit-only and is never required
+ * for the merge decision (BAPI-525 Change A).
+ */
+function resolveAttributionWorkerId(event, identity, resolve) {
+    if (typeof event.worker_id === "string" && event.worker_id.trim().length > 0) {
+        return event.worker_id.trim();
+    }
+    if (resolve) {
+        const resolved = resolve(event, identity);
+        if (typeof resolved === "string" && resolved.trim().length > 0) {
+            return resolved.trim();
+        }
+    }
+    return null;
+}
 /**
  * Process an eligible `gate.met` event end-to-end: terminal-success short-circuit,
  * API merge call, ordered ledger recording, and sanitized error handling. Never
@@ -68,6 +92,9 @@ export async function processGateMetMerge(access, event, deps = {}) {
         return { processed: false, reason: "ineligible" };
     }
     const actionKey = identity.action_key;
+    // Attribution only — resolved from the event or durable dispatch state, never a
+    // merge gate (BAPI-525 Change A). A null value is tolerated end-to-end.
+    const attributionWorkerId = resolveAttributionWorkerId(event, identity, deps.resolveWorkerIdForGateEvent);
     // Terminal-success short-circuit BEFORE any API call (idempotent across restart).
     if (await checkTerminal(actionKey)) {
         return { processed: false, reason: "already_succeeded" };
@@ -92,7 +119,7 @@ export async function processGateMetMerge(access, event, deps = {}) {
             reason,
             details: baseDetails,
             run_id: event.run_id ?? null,
-            worker_id: event.worker_id ?? null,
+            worker_id: attributionWorkerId,
             summary: `merge.failed ${reason}`,
         }, { emitEvent: deps.emitEvent });
         return { processed: true, outcome: "api_error", reason };
@@ -119,7 +146,7 @@ export async function processGateMetMerge(access, event, deps = {}) {
             reason: ledgerEvent.reason ?? null,
             details: ledgerEvent.details ?? baseDetails,
             run_id: event.run_id ?? null,
-            worker_id: event.worker_id ?? null,
+            worker_id: attributionWorkerId,
         }, { emitEvent: deps.emitEvent });
         emitted.push({ type: ledgerEvent.type, emitted: result.emitted });
     }

package/build/conductor/taxonomy.js

@@ -51,6 +51,14 @@ export const SEMANTIC_EVENT_TYPES = [
     // post-merge repository re-index, so the (stateless) reconcile loop can fold a
     // merged ticket to `done` from the ledger instead of an in-memory wait map.
     "parse.triggered",
+    // BAPI-527: durable parse-after-merge TERMINAL markers. Emitted by epic-tick
+    // once the durable `/jira/parse-status` surface reports a terminal outcome for a
+    // triggered post-merge parse: `parse.succeeded` lets the merge.succeeded signal
+    // proceed to `done`; `parse.failed` folds the ticket to `blocked` (and escalates).
+    // Payloads are compact (summary/status/reason/details with epic_key + ticket_key
+    // + bounded parse error metadata) — never subprocess stdout/stderr/stacks/commands.
+    "parse.succeeded",
+    "parse.failed",
 ];
 /**
  * Type guard: returns `true` only when `value` is one of the exact taxonomy