@bridge_gpt/mcp-server 0.2.53 → 0.2.55

package/build/conductor/epic-runtime.js

@@ -1,7 +1,7 @@
 /**
  * Epic Supervisor stateless reconciliation tick (BAPI-408).
  *
- * `conductor epic-tick --epic-key <key>` runs one stateless pass:
+ * `epic-implementer epic-tick --epic-key <key>` runs one stateless pass:
  *   1. Claim the epic supervision lease (single-writer guard)
  *   2. Drift check (log if fired materially late)
  *   3. Rebuild observed state from Postgres + local ledger
@@ -39,6 +39,7 @@ import { createDefaultStartTicketsDeps, orchestrateStartTickets } from "../start
 import { orchestrateReviewTickets } from "../review-tickets.js";
 import { createStartTicketsConductorContext, provisionConductorHooksForRows, emitStartTicketsRunStarted, } from "../start-tickets-conductor.js";
 import { validateBranchName } from "../base-ref.js";
+import { resolveDeclaredRunBaseBranch } from "./run-branch.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -1108,15 +1109,26 @@ export async function runEpicTick(options, deps = {}) {
             // tickets, gated by quiescence. Invert the impl-dispatch maps so ledger
             // events can be attributed back to a ticket for local-first PR binding.
             const dispatchedBackstopPolicy = resolveDispatchedBackstopPolicy(epicRunState.epic_run.policy_json);
-            // BAPI-586: resolve the run's configured base branch so the done-gate pass
-            // can catch a wrong-base PR (one not targeting the run base) at
-            // reconciliation time — the backstop to the executor's own finalization
-            // guard. A malformed configured base defaults to undefined (base check
-            // skipped) rather than failing the whole tick; dispatch already fails
-            // closed on a malformed base separately.
-            const runBaseResolution = resolveConfiguredRunBaseBranch(epicRunState.epic_run.policy_json);
+            // BAPI-586/BAPI-1127: resolve the run's EFFECTIVE base branch so the
+            // done-gate pass can catch a wrong-base PR (one not targeting the run
+            // base) at reconciliation time — the backstop to the executor's own
+            // finalization guard.
+            //
+            // BAPI-1127 moved branch-name validation out of the shared declaration
+            // resolver and into this operational wrapper, so this call site now owns
+            // the fail-closed disposition it used to inherit. It fails CLOSED: when
+            // the declared base is not a usable ref the pass is SKIPPED entirely
+            // rather than run with the base comparison silently disabled. A pass that
+            // cannot verify a PR's base cannot honestly admit one as done, and the
+            // wrong-base PR this check exists to catch is exactly what would slip
+            // through. The skip happens BEFORE any PR binding resolution, CI
+            // observation, or provider call, and reports only the failed rule.
+            const runBaseResolution = resolveEffectiveRunBaseBranch(epicRunState.epic_run.policy_json);
+            if (!runBaseResolution.ok) {
+                errorLog(`[epic-tick] done-gate pass skipped for ${epic_key}: ${runBaseResolution.error}`);
+            }
             const doneGateExpectedBaseBranch = runBaseResolution.ok
-                ? runBaseResolution.baseBranch
+                ? runBaseResolution.effectiveBaseBranch
                 : undefined;
             const ticketForRunId = new Map();
             for (const [tk, rid] of ticketRunIdMap)
@@ -1134,63 +1146,65 @@ export async function runEpicTick(options, deps = {}) {
                 policy: dispatchedBackstopPolicy,
                 resolveImplRunId: resolveTicketRunId,
             });
-            await runConductorDoneGatePass(observed.ticket_statuses, {
-                observePrCi: observePrCiSeamFn,
-                // BAPI-586: the run base so the done-gate pass fails a wrong-base PR
-                // before CI/review evaluation (reconciliation backstop to executor
-                // finalization).
-                expectedBaseBranch: doneGateExpectedBaseBranch,
-                resolvePrBinding,
-                // BAPI-525 Change B: local-first binding + quiescence gate for the new
-                // dispatched/running admission (policy default OFF ⇒ no behavior change).
-                resolveActivePrBinding,
-                dispatchedBackstopPolicy,
-                resolveActiveTicketQuiescence,
-                // BAPI-487: re-evaluate a blocked ticket only when its PR head advanced
-                // past the head recorded on its latest blocking signal.
-                resolveBlockedHeadSha: (tk) => observed.ticket_blocked_heads?.get(tk) ?? null,
-                resolveRunId: resolveTicketRunId,
-                resolveWorkerId: resolveDoneGateWorkerId,
-                // BAPI-494: convert a detected conflict into a durable, head-scoped
-                // `merge.conflict` ledger event stamped with the ticket's dispatch run/worker
-                // so the fold correlates it and the remediation pass redispatches. Emitted via
-                // the shared injectable emitter, idempotent per conflict head. Folded next tick
-                // (this pass runs after rebuildObservedState), matching the gate.met latency.
-                emitConflictSignal: (input) => {
-                    emitConductorEventFn({
-                        source: MERGE_CONFLICT_EVENT_SOURCE,
-                        type: "merge.conflict",
-                        subject: input.ticketKey,
-                        run_id: input.runId,
-                        worker_id: input.workerId,
-                        producer: MERGE_CONFLICT_EVENT_PRODUCER,
-                        observed_via: "supervisor",
-                        time: new Date(nowFn()).toISOString(),
-                        data: {
-                            summary: `PR #${input.prNumber} for ${input.ticketKey} is not mergeable`,
-                            status: "blocked",
-                            reason: "merge.conflict",
-                            details: {
-                                epic_key,
-                                ticket_key: input.ticketKey,
-                                repo: input.repoName,
-                                pr_number: input.prNumber,
-                                head_sha: input.headSha,
-                                mergeable: input.mergeable,
-                                mergeStateStatus: input.mergeStateStatus,
+            if (runBaseResolution.ok) {
+                await runConductorDoneGatePass(observed.ticket_statuses, {
+                    observePrCi: observePrCiSeamFn,
+                    // BAPI-586: the run base so the done-gate pass fails a wrong-base PR
+                    // before CI/review evaluation (reconciliation backstop to executor
+                    // finalization).
+                    expectedBaseBranch: doneGateExpectedBaseBranch,
+                    resolvePrBinding,
+                    // BAPI-525 Change B: local-first binding + quiescence gate for the new
+                    // dispatched/running admission (policy default OFF ⇒ no behavior change).
+                    resolveActivePrBinding,
+                    dispatchedBackstopPolicy,
+                    resolveActiveTicketQuiescence,
+                    // BAPI-487: re-evaluate a blocked ticket only when its PR head advanced
+                    // past the head recorded on its latest blocking signal.
+                    resolveBlockedHeadSha: (tk) => observed.ticket_blocked_heads?.get(tk) ?? null,
+                    resolveRunId: resolveTicketRunId,
+                    resolveWorkerId: resolveDoneGateWorkerId,
+                    // BAPI-494: convert a detected conflict into a durable, head-scoped
+                    // `merge.conflict` ledger event stamped with the ticket's dispatch run/worker
+                    // so the fold correlates it and the remediation pass redispatches. Emitted via
+                    // the shared injectable emitter, idempotent per conflict head. Folded next tick
+                    // (this pass runs after rebuildObservedState), matching the gate.met latency.
+                    emitConflictSignal: (input) => {
+                        emitConductorEventFn({
+                            source: MERGE_CONFLICT_EVENT_SOURCE,
+                            type: "merge.conflict",
+                            subject: input.ticketKey,
+                            run_id: input.runId,
+                            worker_id: input.workerId,
+                            producer: MERGE_CONFLICT_EVENT_PRODUCER,
+                            observed_via: "supervisor",
+                            time: new Date(nowFn()).toISOString(),
+                            data: {
+                                summary: `PR #${input.prNumber} for ${input.ticketKey} is not mergeable`,
+                                status: "blocked",
+                                reason: "merge.conflict",
+                                details: {
+                                    epic_key,
+                                    ticket_key: input.ticketKey,
+                                    repo: input.repoName,
+                                    pr_number: input.prNumber,
+                                    head_sha: input.headSha,
+                                    mergeable: input.mergeable,
+                                    mergeStateStatus: input.mergeStateStatus,
+                                },
                             },
-                        },
-                    }, {
-                        event_type: "merge.conflict",
-                        run_id: input.runId ?? undefined,
-                        commit_sha: input.headSha,
-                    });
-                },
-                access,
-                env,
-                log,
-                errorLog,
-            });
+                        }, {
+                            event_type: "merge.conflict",
+                            run_id: input.runId ?? undefined,
+                            commit_sha: input.headSha,
+                        });
+                    },
+                    access,
+                    env,
+                    log,
+                    errorLog,
+                });
+            }
             const maxSeqForRun = (runId) => {
                 let maxSeq = 0;
                 for (const ev of localEvents) {
@@ -1554,39 +1568,46 @@ export async function runEpicTick(options, deps = {}) {
     }
 }
 /**
- * BAPI-586: resolve the epic run's configured base branch from `policy_json`
- * (`base_branch`, else `baseBranch`), mirroring the server-side reconciler's
- * spec-review base resolution. The authoritative run base — NOT a hard-coded
- * `main` — is what every fresh dispatch and PR must target.
+ * BAPI-586/BAPI-1127: resolve the epic run's EFFECTIVE base branch — the branch
+ * every fresh dispatch cuts from and every child PR targets.
+ *
+ * Two layers, deliberately kept apart:
  *
- * - absent/empty → `main` (the legacy/default value).
- * - present and a valid branch name → that branch (e.g. `develop`).
- * - present but malformed (non-string, `..`, `.lock`, control chars, leading `-`)
- *   → a contract failure so dispatch fails CLOSED rather than emitting a malformed
- *   base (a wrong base is exactly the BAPI-586 defect).
+ * 1. DECLARATION, delegated in full to the dependency-free
+ *    {@link resolveDeclaredRunBaseBranch} leaf, which is the shared cross-runtime
+ *    contract this function does not get a second opinion about. The ordered
+ *    `base_branch` → `baseBranch` scan, the skip-and-continue treatment of a
+ *    non-string or blank candidate, and the trim all live there.
+ * 2. OPERATIONAL POLICY, which is this function's own and is NOT shared with
+ *    Python: an undeclared policy defaults to `main`, and the branch that will
+ *    actually be handed to git is validated before it is returned.
+ *
+ * The frozen dispositions (BAPI-1127) show up here as follows:
+ *
+ * - A NON-STRING candidate is absent, not fatal. `{base_branch: 42,
+ *   baseBranch: "epic/X"}` now resolves to `epic/X`; before BAPI-1127 it failed
+ *   closed, and `{base_branch: "", baseBranch: "epic/X"}` reported `main` — a
+ *   different real branch from the one the server provisioned.
+ * - A MALFORMED declared name does NOT fall back to `main`. Silently
+ *   substituting the default for a bad declaration is how a wrong base becomes
+ *   invisible (the BAPI-586 defect), so it fails closed and dispatch refuses.
+ *   Only an ACTUAL absence of a declaration reaches the default.
+ *
+ * Validation happens here, once, ahead of both operational consumers (dispatch
+ * and the done gate) rather than inside the shared resolver, so that Python and
+ * TypeScript agree about what a policy declares while each keeps its own
+ * judgment about what is safe to use. The failure carries only the rule that
+ * failed — never the policy document or an unbounded branch value.
  */
-export function resolveConfiguredRunBaseBranch(policyJson) {
+export function resolveEffectiveRunBaseBranch(policyJson) {
     const DEFAULT_BASE = "main";
-    if (!policyJson || typeof policyJson !== "object") {
-        return { ok: true, baseBranch: DEFAULT_BASE };
-    }
-    const raw = policyJson.base_branch ??
-        policyJson.baseBranch;
-    if (raw === undefined || raw === null) {
-        return { ok: true, baseBranch: DEFAULT_BASE };
-    }
-    if (typeof raw !== "string") {
-        return { ok: false, error: "epic run policy base_branch is present but is not a string." };
-    }
-    const trimmed = raw.trim();
-    if (trimmed.length === 0) {
-        return { ok: true, baseBranch: DEFAULT_BASE };
-    }
-    const validationError = validateBranchName(trimmed);
+    const declaredBaseBranch = resolveDeclaredRunBaseBranch(policyJson);
+    const effectiveBaseBranch = declaredBaseBranch ?? DEFAULT_BASE;
+    const validationError = validateBranchName(effectiveBaseBranch);
     if (validationError) {
         return { ok: false, error: `epic run policy base_branch is invalid: ${validationError}` };
     }
-    return { ok: true, baseBranch: trimmed };
+    return { ok: true, declaredBaseBranch, effectiveBaseBranch };
 }
 /**
  * Build the production EpicRuntimeDeps for use inside `runEpicTickCommand`.
@@ -1615,13 +1636,23 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
     // error (observe-only would already default to `main`); a malformed configured
     // base is captured as an error and re-raised at dispatch time so a bad base
     // never silently dispatches.
-    let cachedRunBase = { ok: true, baseBranch: "main" };
+    //
+    // BAPI-1127: the fetch-failure fallback declares NOTHING and dispatches from
+    // `main`, which is what "we could not read the policy" honestly means — the
+    // two values are kept separate so a later reader cannot mistake the default
+    // for a declaration the run never made.
+    const UNDECLARED_MAIN = {
+        ok: true,
+        declaredBaseBranch: undefined,
+        effectiveBaseBranch: "main",
+    };
+    let cachedRunBase = UNDECLARED_MAIN;
     try {
         const runState = await fetchEpicRunState(access, epicKey);
-        cachedRunBase = resolveConfiguredRunBaseBranch(runState.epic_run.policy_json);
+        cachedRunBase = resolveEffectiveRunBaseBranch(runState.epic_run.policy_json);
     }
     catch {
-        cachedRunBase = { ok: true, baseBranch: "main" };
+        cachedRunBase = UNDECLARED_MAIN;
     }
     // Shared closure state populated by fetchPlan and consumed by dispatchSeam.
     let cachedPlanVersion = 0;
@@ -1687,12 +1718,17 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         if (cachedPlanVersion === 0) {
             throw new Error(`dispatchSeam called before fetchPlan for epic ${ek} ticket ${tk}; cachedPlanVersion is 0`);
         }
-        // BAPI-586: fail CLOSED on a malformed configured run base rather than
-        // dispatching a worker (and opening a PR) against a bad base.
+        // BAPI-586/BAPI-1127: fail CLOSED on a malformed configured run base rather
+        // than dispatching a worker (and opening a PR) against a bad base. The check
+        // is here — ahead of the dispatch claim, the spawn command, and any git or
+        // provider work — because `resolveEffectiveRunBaseBranch` validates the ref
+        // but this is the boundary that actually uses it. Only `effectiveBaseBranch`
+        // (declaration, else `main`) is handed on; the declaration itself stays
+        // separately readable on `cachedRunBase` and is never overwritten.
         if (!cachedRunBase.ok) {
             throw new Error(`invalid configured base branch for epic ${ek}: ${cachedRunBase.error}`);
         }
-        const runBaseBranch = cachedRunBase.baseBranch;
+        const runBaseBranch = cachedRunBase.effectiveBaseBranch;
         // BAPI-441: a remediation re-dispatch (attempt > 0) reuses the existing
         // branch/worktree (resume mode) and claims an attempt-scoped dispatch key so
         // it is not deduped against the original epic dispatch.

package/build/conductor/errors.js

@@ -62,7 +62,7 @@ export class ConductorStoreError extends Error {
     }
 }
 /**
- * Raised when the frozen v1 `conductor epic-tick` entrypoint is invoked
+ * Raised when the frozen v1 `epic-implementer epic-tick` entrypoint is invoked
  * (BAPI-534, Epic Conductor v2 slice 0). The v1 local reconciler/ledger tick is
  * frozen: Epic Conductor v2 replaces it with a server-side reconciler plus the
  * local executor (`mcp-server executor`). The message points operators at the v2
@@ -70,7 +70,7 @@ export class ConductorStoreError extends Error {
  */
 export class ConductorEpicTickV1FrozenError extends Error {
     constructor() {
-        super("The v1 `conductor epic-tick` path is frozen (EPIC_TICK_V1_FROZEN). Epic " +
+        super("The v1 `epic-implementer epic-tick` path is frozen (EPIC_TICK_V1_FROZEN). Epic " +
             "Conductor v2 replaces the local epic tick with a server-side reconciler " +
             "plus the local executor — run `mcp-server executor` instead.");
         this.name = "ConductorEpicTickV1FrozenError";

package/build/conductor/git-ci-types.js

@@ -155,7 +155,7 @@ export function stableJsonHash(value) {
  * The two literals are exported as named constants so no consumer spells them
  * inline — a typo in one consumer would otherwise silently disagree with the
  * parser about which disposition is configured. The Python mirror lives in
- * `api/library/epic_conductor/conductor_readiness.py` and must carry the same
+ * `api/library/epic_conductor/epic_implementer_readiness.py` and must carry the same
  * closed set.
  */
 export const VERDICTLESS_DISPOSITION_PARK = "park";

package/build/conductor/git-hooks.js

@@ -1,7 +1,7 @@
 /**
  * Managed, non-blocking local git hook installation and verification (BAPI-395).
  *
- * `conductor install-git-hooks` installs opportunistic `post-commit` and
+ * `epic-implementer install-git-hooks` installs opportunistic `post-commit` and
  * `reference-transaction` hooks that launch the conductor producer in the
  * background and never block the user's git workflow. Hooks are LOCAL and
  * unversioned: only a clearly-delimited managed block is inserted/replaced, all
@@ -36,8 +36,13 @@ export function resolveGitHooksDirectory(deps = {}) {
     const absoluteCommonDir = isAbsolute(commonDir) ? commonDir : resolve(cwd, commonDir);
     return { is_worktree: true, hooks_dir: resolve(absoluteCommonDir, "hooks") };
 }
-/** The file name every managed hook body must invoke. */
-export const CONDUCTOR_BIN_FILENAME = "conductor-bin.js";
+/**
+ * The file name every managed hook body must invoke. S4 (BAPI-1080): this is
+ * the renamed REAL event-ledger bin output; the retained `conductor-bin.js`
+ * output name is now a fixed, failing migration stub and must never be
+ * resolved here.
+ */
+export const CONDUCTOR_BIN_FILENAME = "epic-implementer-bin.js";
 /**
  * The sanitized failure reason. Names the layout categories that were searched
  * so the operator can act, and nothing else — no probed path, no caught error
@@ -48,18 +53,19 @@ export const CONDUCTOR_HOOK_BIN_UNRESOLVED_REASON = `no usable ${CONDUCTOR_BIN_F
     `the invocation target when it is named ${CONDUCTOR_BIN_FILENAME}). ` +
     "Reinstall or rebuild the package so a conductor binary ships beside the executing module.";
 /**
- * Absolute, canonical path of the `conductor-bin.js` belonging to the artifact
- * that is currently executing (BAPI-772, the BAPI-768 pattern applied to hooks).
+ * Absolute, canonical path of the `epic-implementer-bin.js` belonging to the
+ * artifact that is currently executing (BAPI-772, the BAPI-768 pattern applied
+ * to hooks; renamed from `conductor-bin.js` by S4/BAPI-1080).
  *
  * ## Why this cannot be path arithmetic
  *
  * The old implementation hard-coded ONE layout — `dirname(import.meta.url)/../
  * conductor-bin.js`, the tsc emit — and returned it unverified. In the shipped
- * esbuild bundle this module IS `build/conductor-bin.js`, so the directory hop
- * landed on `<pkg>/conductor-bin.js`, a path that has never existed. Every hook
+ * esbuild bundle this module IS `build/epic-implementer-bin.js`, so the directory hop
+ * landed on `<pkg>/epic-implementer-bin.js`, a path that has never existed. Every hook
  * installed from the published package embedded that dead path, and because hook
  * bodies discard output and end in `|| true`, each commit ENOENTed in silence
- * while `conductor doctor` still called the hooks healthy.
+ * while `epic-implementer doctor` still called the hooks healthy.
  *
  * So this resolver PROBES. Candidates are drawn only from the executing module's
  * own URL and Node's actual invocation target — never `process.cwd()` or an
@@ -82,13 +88,13 @@ export function resolveConductorHookBin(overrides = {}) {
         // Bundled layout: the bin sits beside the executing module (and in the
         // single-file bundle it IS the executing module).
         candidates.push(join(dir, CONDUCTOR_BIN_FILENAME));
-        // tsc layout: `build/conductor/git-hooks.js` → `build/conductor-bin.js`.
+        // tsc layout: `build/conductor/git-hooks.js` → `build/epic-implementer-bin.js`.
         candidates.push(join(dir, "..", CONDUCTOR_BIN_FILENAME));
     }
     // Last resort, and only ever a validated one: a packaged install launches
     // through a `node_modules/.bin` symlink. Accepted only when the invocation
-    // target is exactly the conductor bin — `index.js` or `conductor-bin.js.bak`
-    // must never become a hook target.
+    // target is exactly the epic-implementer bin — `index.js` or
+    // `epic-implementer-bin.js.bak` must never become a hook target.
     if (typeof deps.argv1 === "string" && deps.argv1.length > 0) {
         if (basename(deps.argv1) === CONDUCTOR_BIN_FILENAME)
             candidates.push(deps.argv1);
@@ -379,14 +385,22 @@ export function inspectConductorGitHooks(deps = {}) {
                     // embedded target READ-ONLY so a dead hook is visible instead of
                     // reported healthy. Nothing here rewrites or canonicalizes the hook.
                     embeddedBinPath = extractManagedHookBinPath(content);
-                    embeddedBinIsFile = embeddedBinPath !== null && defaultIsFile(embeddedBinPath);
+                    // S4 (BAPI-1080): a hook installed before the rename still embeds
+                    // the old `conductor-bin.js` path, which still exists post-upgrade
+                    // as the migration stub — stat-true but dead. Require the embedded
+                    // path's basename to be the current real bin so a stale hook is
+                    // correctly flagged degraded instead of reported healthy.
+                    embeddedBinIsFile =
+                        embeddedBinPath !== null &&
+                            basename(embeddedBinPath) === CONDUCTOR_BIN_FILENAME &&
+                            defaultIsFile(embeddedBinPath);
                     if (embeddedBinPath === null) {
                         warnings.push(`${name} hook has a managed block with no recognizable conductor command; ` +
-                            "reinstall with `conductor install-git-hooks`");
+                            "reinstall with `epic-implementer install-git-hooks`");
                     }
                     else if (!embeddedBinIsFile) {
                         warnings.push(`${name} hook points at a missing or invalid conductor binary (${embeddedBinPath}); ` +
-                            "the hook is dead — reinstall with `conductor install-git-hooks`");
+                            "the hook is dead — reinstall with `epic-implementer install-git-hooks`");
                     }
                 }
             }

package/build/conductor/install-doctor.js

@@ -36,7 +36,7 @@ import { buildConductorDoctorReport, formatConductorDoctorReport, } from "./doct
 import { inspectBridgeApiProfileToken, } from "../mcp-host-config.js";
 import { collectExecutorServiceDiagnostics, formatExecutorServiceDiagnosticsReport, } from "../doctor.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, } from "../install-doctor.js";
-import { conductorHookTargetsSection, conductorLedgerLoadabilitySection, conductorProfileTokenSection, CONDUCTOR_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
+import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, conductorProfileTokenSection, CONDUCTOR_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
 import { ConductorBridgeApiError, fetchConductorReadiness, } from "./bridge-api-client.js";
 /**
  * Run one optional collector, containing any throw.
@@ -89,8 +89,8 @@ export async function runConductorInstallDoctor(deps) {
             id: "conductor-ledger",
             label: "Conductor ledger doctor",
             status: "degraded",
-            detail: "the local conductor doctor could not be built",
-            remediation: "run `conductor doctor` directly to see why the local ledger report failed.",
+            detail: "the local epic-implementer doctor could not be built",
+            remediation: "run `epic-implementer doctor` directly to see why the local ledger report failed.",
         });
     }
     const legacyExecutorPreflight = executorPreflightSettled.value ?? null;
@@ -161,6 +161,10 @@ export async function runConductorInstallDoctor(deps) {
     const workflow = await inspectWorkflowPresence(deps.readWorkflowFile, deps.classifyWorkflowDrift);
     sections.push(workflowSection(workflow.presence, deps.reviewPolicySource, workflow.driftDetail));
     if (readiness) {
+        // BAPI-1153 — the "Bring-up safety" group, ahead of the repository-scoped
+        // reconciler/executor story: these three decide whether a plane can drive a
+        // run at all, and `setup-epic` refuses on them before a run exists.
+        sections.push(...bringUpSafetySections(readiness));
         sections.push(reconcilerSection(readiness));
     }
     // --- Executor provisioning (BAPI-688): real, read-only unit detection -----
@@ -326,9 +330,11 @@ export function conductorInstallDoctorHasFatal(report) {
 //
 // The section contract and every pure section builder now live in
 // `readiness-sections.ts`, so the install-time doctor and the advisory
-// `conductor readiness` gate share ONE adapter set. They are re-exported from
+// `epic-implementer readiness` gate share ONE adapter set. They are re-exported from
 // here unchanged: every existing import of `ConductorInstallSection`, the
 // remediation constants, or the installer reporting APIs from
 // `conductor/install-doctor.js` keeps resolving exactly as before.
 // ---------------------------------------------------------------------------
-export { CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, CONDUCTOR_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, } from "./readiness-sections.js";
+export { BRING_UP_SECTION_LABELS, bringUpSafetySections, databaseMigrationCurrentSection, singleTransitionAuthoritySection, workerPresentSection, CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, CONDUCTOR_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, } from "./readiness-sections.js";
+// BAPI-1153 — the bring-up remediations the three sections above render.
+export { BRING_UP_RUNBOOK, BRING_UP_UNREPORTED_REMEDIATION, DATABASE_MIGRATION_BEHIND_REMEDIATION, DATABASE_MIGRATION_UNREADABLE_REMEDIATION, SECOND_RECONCILER_REMEDIATION, WORKER_HEARTBEAT_UNREADABLE_REMEDIATION, WORKER_NOT_PRESENT_REMEDIATION, } from "./bring-up-facts.js";

package/build/conductor/readiness-cli.js

@@ -1,5 +1,5 @@
 /**
- * The `conductor readiness` command surface (BAPI-1055, AC-6).
+ * The `epic-implementer readiness` command surface (BAPI-1055, AC-6).
  *
  * A CLI subcommand, deliberately, and NOT an MCP tool. Every peer diagnostic in
  * this package — `doctor`, `plane`, `drive-epic`, `executor`, `install` — is an
@@ -40,13 +40,13 @@ import { claudeReviewWorkflowPath } from "../claude-review-workflow.js";
 import { runDefaultPlanePreflight } from "../plane/cli.js";
 /** Fixed notice emitted to stderr when a source could not be collected. */
 export const READINESS_COLLECTION_NOTICE = "one or more readiness sources could not be collected; the affected prerequisites are reported as failures.";
-/** Usage text for `conductor readiness`. */
+/** Usage text for `epic-implementer readiness`. */
 export function getReadinessUsage() {
     return [
-        "Usage: conductor readiness [--json] [--no-deny-probe]",
+        "Usage: epic-implementer readiness [--json] [--no-deny-probe]",
         "",
         "Read-only ADVISORY report of every conductor prerequisite, consolidated from the",
-        "Bridge install checklist, the conductor doctor, the plane preflight, and the",
+        "Bridge install checklist, the epic-implementer doctor, the plane preflight, and the",
         "server conductor-readiness collector. Each prerequisite reports pass/warn/fail/skip",
         "and, on a failure, exactly ONE named remediation.",
         "",
@@ -56,12 +56,12 @@ export function getReadinessUsage() {
         "",
         "Options:",
         "  --json            Print the versioned structured report as JSON",
-        "  --no-deny-probe   Accepted for parity with `conductor doctor`; inert here, because",
+        "  --no-deny-probe   Accepted for parity with `epic-implementer doctor`; inert here, because",
         "                    this command never spawns the deny-enforcement probe",
         "  --help            Print this usage message",
     ].join("\n");
 }
-/** Parse `conductor readiness` argv. Unknown flags and positionals are errors. */
+/** Parse `epic-implementer readiness` argv. Unknown flags and positionals are errors. */
 export function parseReadinessArgs(argv) {
     const parsed = { json: false, help: false, noDenyProbe: false };
     for (const token of argv) {
@@ -72,7 +72,7 @@ export function parseReadinessArgs(argv) {
         else if (token === "--help" || token === "-h")
             parsed.help = true;
         else
-            return { error: `Unknown argument "${token}". Run "conductor readiness --help" for usage.` };
+            return { error: `Unknown argument "${token}". Run "epic-implementer readiness --help" for usage.` };
     }
     return parsed;
 }
@@ -80,7 +80,7 @@ export function parseReadinessArgs(argv) {
  * Build the production report for `repoRoot`.
  *
  * Every seam is a real, READ-ONLY one: the install doctor's own GET, the
- * conductor doctor's local inspections, and the same plane preflight
+ * epic-implementer doctor's local inspections, and the same plane preflight
  * `plane up` and `drive-epic` run. Nothing is re-implemented here.
  */
 async function collectProductionReport(repoRoot, env) {
@@ -111,13 +111,13 @@ async function collectProductionReport(repoRoot, env) {
             },
         },
         // The deny-enforcement probe is never spawned from this command; the check
-        // is reported as an explicit skip naming `conductor doctor` instead.
+        // is reported as an explicit skip naming `epic-implementer doctor` instead.
         conductorDoctorDeps: { env, skipDenyProbe: true },
         runPlanePreflight: () => runDefaultPlanePreflight(repoRoot, env),
     });
 }
 /**
- * Run `conductor readiness`.
+ * Run `epic-implementer readiness`.
  *
  * Returns 0 for every readiness outcome; see the module docstring. The only
  * non-zero return is a usage error.