@bridge_gpt/mcp-server 0.2.54 → 0.2.55

package/build/conductor/epic-runtime.js

@@ -1,7 +1,7 @@
 /**
  * Epic Supervisor stateless reconciliation tick (BAPI-408).
  *
- * `conductor epic-tick --epic-key <key>` runs one stateless pass:
+ * `epic-implementer epic-tick --epic-key <key>` runs one stateless pass:
  *   1. Claim the epic supervision lease (single-writer guard)
  *   2. Drift check (log if fired materially late)
  *   3. Rebuild observed state from Postgres + local ledger

package/build/conductor/errors.js

@@ -62,7 +62,7 @@ export class ConductorStoreError extends Error {
     }
 }
 /**
- * Raised when the frozen v1 `conductor epic-tick` entrypoint is invoked
+ * Raised when the frozen v1 `epic-implementer epic-tick` entrypoint is invoked
  * (BAPI-534, Epic Conductor v2 slice 0). The v1 local reconciler/ledger tick is
  * frozen: Epic Conductor v2 replaces it with a server-side reconciler plus the
  * local executor (`mcp-server executor`). The message points operators at the v2
@@ -70,7 +70,7 @@ export class ConductorStoreError extends Error {
  */
 export class ConductorEpicTickV1FrozenError extends Error {
     constructor() {
-        super("The v1 `conductor epic-tick` path is frozen (EPIC_TICK_V1_FROZEN). Epic " +
+        super("The v1 `epic-implementer epic-tick` path is frozen (EPIC_TICK_V1_FROZEN). Epic " +
             "Conductor v2 replaces the local epic tick with a server-side reconciler " +
             "plus the local executor — run `mcp-server executor` instead.");
         this.name = "ConductorEpicTickV1FrozenError";

package/build/conductor/git-ci-types.js

@@ -155,7 +155,7 @@ export function stableJsonHash(value) {
  * The two literals are exported as named constants so no consumer spells them
  * inline — a typo in one consumer would otherwise silently disagree with the
  * parser about which disposition is configured. The Python mirror lives in
- * `api/library/epic_conductor/conductor_readiness.py` and must carry the same
+ * `api/library/epic_conductor/epic_implementer_readiness.py` and must carry the same
  * closed set.
  */
 export const VERDICTLESS_DISPOSITION_PARK = "park";

package/build/conductor/git-hooks.js

@@ -1,7 +1,7 @@
 /**
  * Managed, non-blocking local git hook installation and verification (BAPI-395).
  *
- * `conductor install-git-hooks` installs opportunistic `post-commit` and
+ * `epic-implementer install-git-hooks` installs opportunistic `post-commit` and
  * `reference-transaction` hooks that launch the conductor producer in the
  * background and never block the user's git workflow. Hooks are LOCAL and
  * unversioned: only a clearly-delimited managed block is inserted/replaced, all
@@ -36,8 +36,13 @@ export function resolveGitHooksDirectory(deps = {}) {
     const absoluteCommonDir = isAbsolute(commonDir) ? commonDir : resolve(cwd, commonDir);
     return { is_worktree: true, hooks_dir: resolve(absoluteCommonDir, "hooks") };
 }
-/** The file name every managed hook body must invoke. */
-export const CONDUCTOR_BIN_FILENAME = "conductor-bin.js";
+/**
+ * The file name every managed hook body must invoke. S4 (BAPI-1080): this is
+ * the renamed REAL event-ledger bin output; the retained `conductor-bin.js`
+ * output name is now a fixed, failing migration stub and must never be
+ * resolved here.
+ */
+export const CONDUCTOR_BIN_FILENAME = "epic-implementer-bin.js";
 /**
  * The sanitized failure reason. Names the layout categories that were searched
  * so the operator can act, and nothing else — no probed path, no caught error
@@ -48,18 +53,19 @@ export const CONDUCTOR_HOOK_BIN_UNRESOLVED_REASON = `no usable ${CONDUCTOR_BIN_F
     `the invocation target when it is named ${CONDUCTOR_BIN_FILENAME}). ` +
     "Reinstall or rebuild the package so a conductor binary ships beside the executing module.";
 /**
- * Absolute, canonical path of the `conductor-bin.js` belonging to the artifact
- * that is currently executing (BAPI-772, the BAPI-768 pattern applied to hooks).
+ * Absolute, canonical path of the `epic-implementer-bin.js` belonging to the
+ * artifact that is currently executing (BAPI-772, the BAPI-768 pattern applied
+ * to hooks; renamed from `conductor-bin.js` by S4/BAPI-1080).
  *
  * ## Why this cannot be path arithmetic
  *
  * The old implementation hard-coded ONE layout — `dirname(import.meta.url)/../
  * conductor-bin.js`, the tsc emit — and returned it unverified. In the shipped
- * esbuild bundle this module IS `build/conductor-bin.js`, so the directory hop
- * landed on `<pkg>/conductor-bin.js`, a path that has never existed. Every hook
+ * esbuild bundle this module IS `build/epic-implementer-bin.js`, so the directory hop
+ * landed on `<pkg>/epic-implementer-bin.js`, a path that has never existed. Every hook
  * installed from the published package embedded that dead path, and because hook
  * bodies discard output and end in `|| true`, each commit ENOENTed in silence
- * while `conductor doctor` still called the hooks healthy.
+ * while `epic-implementer doctor` still called the hooks healthy.
  *
  * So this resolver PROBES. Candidates are drawn only from the executing module's
  * own URL and Node's actual invocation target — never `process.cwd()` or an
@@ -82,13 +88,13 @@ export function resolveConductorHookBin(overrides = {}) {
         // Bundled layout: the bin sits beside the executing module (and in the
         // single-file bundle it IS the executing module).
         candidates.push(join(dir, CONDUCTOR_BIN_FILENAME));
-        // tsc layout: `build/conductor/git-hooks.js` → `build/conductor-bin.js`.
+        // tsc layout: `build/conductor/git-hooks.js` → `build/epic-implementer-bin.js`.
         candidates.push(join(dir, "..", CONDUCTOR_BIN_FILENAME));
     }
     // Last resort, and only ever a validated one: a packaged install launches
     // through a `node_modules/.bin` symlink. Accepted only when the invocation
-    // target is exactly the conductor bin — `index.js` or `conductor-bin.js.bak`
-    // must never become a hook target.
+    // target is exactly the epic-implementer bin — `index.js` or
+    // `epic-implementer-bin.js.bak` must never become a hook target.
     if (typeof deps.argv1 === "string" && deps.argv1.length > 0) {
         if (basename(deps.argv1) === CONDUCTOR_BIN_FILENAME)
             candidates.push(deps.argv1);
@@ -379,14 +385,22 @@ export function inspectConductorGitHooks(deps = {}) {
                     // embedded target READ-ONLY so a dead hook is visible instead of
                     // reported healthy. Nothing here rewrites or canonicalizes the hook.
                     embeddedBinPath = extractManagedHookBinPath(content);
-                    embeddedBinIsFile = embeddedBinPath !== null && defaultIsFile(embeddedBinPath);
+                    // S4 (BAPI-1080): a hook installed before the rename still embeds
+                    // the old `conductor-bin.js` path, which still exists post-upgrade
+                    // as the migration stub — stat-true but dead. Require the embedded
+                    // path's basename to be the current real bin so a stale hook is
+                    // correctly flagged degraded instead of reported healthy.
+                    embeddedBinIsFile =
+                        embeddedBinPath !== null &&
+                            basename(embeddedBinPath) === CONDUCTOR_BIN_FILENAME &&
+                            defaultIsFile(embeddedBinPath);
                     if (embeddedBinPath === null) {
                         warnings.push(`${name} hook has a managed block with no recognizable conductor command; ` +
-                            "reinstall with `conductor install-git-hooks`");
+                            "reinstall with `epic-implementer install-git-hooks`");
                     }
                     else if (!embeddedBinIsFile) {
                         warnings.push(`${name} hook points at a missing or invalid conductor binary (${embeddedBinPath}); ` +
-                            "the hook is dead — reinstall with `conductor install-git-hooks`");
+                            "the hook is dead — reinstall with `epic-implementer install-git-hooks`");
                     }
                 }
             }

package/build/conductor/install-doctor.js

@@ -36,7 +36,7 @@ import { buildConductorDoctorReport, formatConductorDoctorReport, } from "./doct
 import { inspectBridgeApiProfileToken, } from "../mcp-host-config.js";
 import { collectExecutorServiceDiagnostics, formatExecutorServiceDiagnosticsReport, } from "../doctor.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, } from "../install-doctor.js";
-import { conductorHookTargetsSection, conductorLedgerLoadabilitySection, conductorProfileTokenSection, CONDUCTOR_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
+import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, conductorProfileTokenSection, CONDUCTOR_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
 import { ConductorBridgeApiError, fetchConductorReadiness, } from "./bridge-api-client.js";
 /**
  * Run one optional collector, containing any throw.
@@ -89,8 +89,8 @@ export async function runConductorInstallDoctor(deps) {
             id: "conductor-ledger",
             label: "Conductor ledger doctor",
             status: "degraded",
-            detail: "the local conductor doctor could not be built",
-            remediation: "run `conductor doctor` directly to see why the local ledger report failed.",
+            detail: "the local epic-implementer doctor could not be built",
+            remediation: "run `epic-implementer doctor` directly to see why the local ledger report failed.",
         });
     }
     const legacyExecutorPreflight = executorPreflightSettled.value ?? null;
@@ -161,6 +161,10 @@ export async function runConductorInstallDoctor(deps) {
     const workflow = await inspectWorkflowPresence(deps.readWorkflowFile, deps.classifyWorkflowDrift);
     sections.push(workflowSection(workflow.presence, deps.reviewPolicySource, workflow.driftDetail));
     if (readiness) {
+        // BAPI-1153 — the "Bring-up safety" group, ahead of the repository-scoped
+        // reconciler/executor story: these three decide whether a plane can drive a
+        // run at all, and `setup-epic` refuses on them before a run exists.
+        sections.push(...bringUpSafetySections(readiness));
         sections.push(reconcilerSection(readiness));
     }
     // --- Executor provisioning (BAPI-688): real, read-only unit detection -----
@@ -326,9 +330,11 @@ export function conductorInstallDoctorHasFatal(report) {
 //
 // The section contract and every pure section builder now live in
 // `readiness-sections.ts`, so the install-time doctor and the advisory
-// `conductor readiness` gate share ONE adapter set. They are re-exported from
+// `epic-implementer readiness` gate share ONE adapter set. They are re-exported from
 // here unchanged: every existing import of `ConductorInstallSection`, the
 // remediation constants, or the installer reporting APIs from
 // `conductor/install-doctor.js` keeps resolving exactly as before.
 // ---------------------------------------------------------------------------
-export { CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, CONDUCTOR_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, } from "./readiness-sections.js";
+export { BRING_UP_SECTION_LABELS, bringUpSafetySections, databaseMigrationCurrentSection, singleTransitionAuthoritySection, workerPresentSection, CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, CONDUCTOR_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, } from "./readiness-sections.js";
+// BAPI-1153 — the bring-up remediations the three sections above render.
+export { BRING_UP_RUNBOOK, BRING_UP_UNREPORTED_REMEDIATION, DATABASE_MIGRATION_BEHIND_REMEDIATION, DATABASE_MIGRATION_UNREADABLE_REMEDIATION, SECOND_RECONCILER_REMEDIATION, WORKER_HEARTBEAT_UNREADABLE_REMEDIATION, WORKER_NOT_PRESENT_REMEDIATION, } from "./bring-up-facts.js";

package/build/conductor/readiness-cli.js

@@ -1,5 +1,5 @@
 /**
- * The `conductor readiness` command surface (BAPI-1055, AC-6).
+ * The `epic-implementer readiness` command surface (BAPI-1055, AC-6).
  *
  * A CLI subcommand, deliberately, and NOT an MCP tool. Every peer diagnostic in
  * this package — `doctor`, `plane`, `drive-epic`, `executor`, `install` — is an
@@ -40,13 +40,13 @@ import { claudeReviewWorkflowPath } from "../claude-review-workflow.js";
 import { runDefaultPlanePreflight } from "../plane/cli.js";
 /** Fixed notice emitted to stderr when a source could not be collected. */
 export const READINESS_COLLECTION_NOTICE = "one or more readiness sources could not be collected; the affected prerequisites are reported as failures.";
-/** Usage text for `conductor readiness`. */
+/** Usage text for `epic-implementer readiness`. */
 export function getReadinessUsage() {
     return [
-        "Usage: conductor readiness [--json] [--no-deny-probe]",
+        "Usage: epic-implementer readiness [--json] [--no-deny-probe]",
         "",
         "Read-only ADVISORY report of every conductor prerequisite, consolidated from the",
-        "Bridge install checklist, the conductor doctor, the plane preflight, and the",
+        "Bridge install checklist, the epic-implementer doctor, the plane preflight, and the",
         "server conductor-readiness collector. Each prerequisite reports pass/warn/fail/skip",
         "and, on a failure, exactly ONE named remediation.",
         "",
@@ -56,12 +56,12 @@ export function getReadinessUsage() {
         "",
         "Options:",
         "  --json            Print the versioned structured report as JSON",
-        "  --no-deny-probe   Accepted for parity with `conductor doctor`; inert here, because",
+        "  --no-deny-probe   Accepted for parity with `epic-implementer doctor`; inert here, because",
         "                    this command never spawns the deny-enforcement probe",
         "  --help            Print this usage message",
     ].join("\n");
 }
-/** Parse `conductor readiness` argv. Unknown flags and positionals are errors. */
+/** Parse `epic-implementer readiness` argv. Unknown flags and positionals are errors. */
 export function parseReadinessArgs(argv) {
     const parsed = { json: false, help: false, noDenyProbe: false };
     for (const token of argv) {
@@ -72,7 +72,7 @@ export function parseReadinessArgs(argv) {
         else if (token === "--help" || token === "-h")
             parsed.help = true;
         else
-            return { error: `Unknown argument "${token}". Run "conductor readiness --help" for usage.` };
+            return { error: `Unknown argument "${token}". Run "epic-implementer readiness --help" for usage.` };
     }
     return parsed;
 }
@@ -80,7 +80,7 @@ export function parseReadinessArgs(argv) {
  * Build the production report for `repoRoot`.
  *
  * Every seam is a real, READ-ONLY one: the install doctor's own GET, the
- * conductor doctor's local inspections, and the same plane preflight
+ * epic-implementer doctor's local inspections, and the same plane preflight
  * `plane up` and `drive-epic` run. Nothing is re-implemented here.
  */
 async function collectProductionReport(repoRoot, env) {
@@ -111,13 +111,13 @@ async function collectProductionReport(repoRoot, env) {
             },
         },
         // The deny-enforcement probe is never spawned from this command; the check
-        // is reported as an explicit skip naming `conductor doctor` instead.
+        // is reported as an explicit skip naming `epic-implementer doctor` instead.
         conductorDoctorDeps: { env, skipDenyProbe: true },
         runPlanePreflight: () => runDefaultPlanePreflight(repoRoot, env),
     });
 }
 /**
- * Run `conductor readiness`.
+ * Run `epic-implementer readiness`.
  *
  * Returns 0 for every readiness outcome; see the module docstring. The only
  * non-zero return is a usage error.

package/build/conductor/readiness-sections.js

@@ -1,11 +1,11 @@
 /**
- * The shared conductor readiness SECTION layer (BAPI-1055).
+ * The shared epic-implementer readiness SECTION layer (BAPI-1055).
  *
  * Extracted verbatim from `conductor/install-doctor.ts`, where these builders
  * had already composed four of the five prerequisite loci. Nothing about a
  * section changed in the move: same ids, same labels, same statuses, same
  * detail text, same installer remediations. What changed is who may consume
- * them — the install-time doctor and the advisory `conductor readiness` gate now
+ * them — the install-time doctor and the advisory `epic-implementer readiness` gate now
  * read ONE adapter set instead of interpreting the same probes twice.
  *
  * ## Why extraction rather than a second aggregator
@@ -37,6 +37,7 @@ import { MANAGED_HOOK_NAMES } from "./git-hooks.js";
 import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { CLAUDE_REVIEW_WORKFLOW_DRIFT_REMEDIATION, summarizeClaudeReviewWorkflowDrift, } from "../claude-review-workflow-drift.js";
 import { describeNativeLedgerAvailability } from "./doctor.js";
+import { classifyDatabaseMigration, classifySingleTransitionAuthority, classifyWorkerPresent, } from "./bring-up-facts.js";
 /** Operator runbook pointer surfaced beside the executor gap. */
 export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-conductor-v2-operator-runbook.md";
 /**
@@ -65,7 +66,7 @@ export const CONDUCTOR_PROFILE_TOKEN_REMEDIATION = "re-run `install conductor` a
     "tools become visible after the MCP client is restarted.";
 /** Remediation surfaced whenever the managed conductor hooks are not usable. */
 export const CONDUCTOR_HOOK_TARGET_REMEDIATION = "re-run `install conductor` and accept the local-observability consent, or run " +
-    "`conductor install-git-hooks` directly.";
+    "`epic-implementer install-git-hooks` directly.";
 /** Remediation surfaced when the ledger's native binding does not load. */
 export const CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION = "`better-sqlite3` is an optionalDependency npm silently skips on a build failure — " +
     "reinstall it for this Node runtime to restore local conductor observability.";
@@ -244,9 +245,57 @@ export function reconcilerSection(readiness) {
         detail: r.last_tick_at === null
             ? "no reconciler tick recorded for this repository"
             : `last tick ${r.last_tick_age_seconds}s ago (threshold ${readiness.thresholds.reconciler_stale_after_seconds}s)`,
-        remediation: "start the reconciler (`conductor epic-tick` schedule) for this repository.",
+        remediation: "start the reconciler (`epic-implementer epic-tick` schedule) for this repository.",
     };
 }
+// ---------------------------------------------------------------------------
+// Bring-up safety (BAPI-1153)
+// ---------------------------------------------------------------------------
+// Three deployment-wide facts, rendered as their own group. Each builder is a
+// thin projection of the ONE classification in `bring-up-facts.ts`, which the
+// advisory gate and the `setup-epic` refusal read too — so the doctor cannot
+// call a database current that setup-epic refuses as behind.
+//
+// Never `fatal`: the installer's fatal state refuses to WRITE, and none of these
+// is a reason not to install. They refuse at `setup-epic`, before a run exists.
+/** Section labels, in render order. Ids come from the shared classification. */
+export const BRING_UP_SECTION_LABELS = {
+    "database-migration-current": "Database migration",
+    "worker-present": "Worker present",
+    "single-transition-authority": "Single transition authority",
+};
+function bringUpSection(verdict) {
+    const base = { id: verdict.id, label: BRING_UP_SECTION_LABELS[verdict.id] };
+    if (verdict.state === "ok") {
+        return { ...base, status: "ok", detail: verdict.detail };
+    }
+    return {
+        ...base,
+        status: "degraded",
+        detail: verdict.detail,
+        ...(verdict.remediation ? { remediation: verdict.remediation } : {}),
+    };
+}
+/** Whether the shared database is at (or ahead of) the server's code heads. */
+export function databaseMigrationCurrentSection(readiness) {
+    return bringUpSection(classifyDatabaseMigration(readiness.bring_up ?? null));
+}
+/** Whether any reconciler (worker) heartbeat is fresh across the deployment. */
+export function workerPresentSection(readiness) {
+    return bringUpSection(classifyWorkerPresent(readiness.bring_up ?? null));
+}
+/** Whether exactly one reconciler holds transition authority. */
+export function singleTransitionAuthoritySection(readiness) {
+    return bringUpSection(classifySingleTransitionAuthority(readiness.bring_up ?? null));
+}
+/** The "Bring-up safety" group, in render order. */
+export function bringUpSafetySections(readiness) {
+    return [
+        databaseMigrationCurrentSection(readiness),
+        workerPresentSection(readiness),
+        singleTransitionAuthoritySection(readiness),
+    ];
+}
 export function workflowSection(presence, reviewPolicySource, driftDetail) {
     if (presence === "present") {
         return {
@@ -527,7 +576,7 @@ export function conductorHookTargetsSection(legacyConductor, conductorContext) {
         return {
             ...base,
             status: "degraded",
-            detail: "hook targets could not be derived (the conductor doctor was not collected)",
+            detail: "hook targets could not be derived (the epic-implementer doctor was not collected)",
             remediation: CONDUCTOR_HOOK_TARGET_REMEDIATION,
         };
     }
@@ -538,7 +587,7 @@ export function conductorHookTargetsSection(legacyConductor, conductorContext) {
         return {
             ...base,
             status: "degraded",
-            detail: "hook targets could not be derived (the conductor doctor reported no hook state)",
+            detail: "hook targets could not be derived (the epic-implementer doctor reported no hook state)",
             remediation: CONDUCTOR_HOOK_TARGET_REMEDIATION,
         };
     }
@@ -576,7 +625,7 @@ export function conductorHookTargetsSection(legacyConductor, conductorContext) {
  *
  * No parallel `better-sqlite3` check: the mapping from an inspection to
  * available/degraded lives in one place ({@link describeNativeLedgerAvailability}),
- * so this section and the conductor doctor can never disagree about whether the
+ * so this section and the epic-implementer doctor can never disagree about whether the
  * binding loads. A degraded result carries the module name, the ABI, and the
  * sanitized failure kind, because the common cause is npm silently skipping an
  * optionalDependency build and that is undiagnosable without the ABI.
@@ -590,7 +639,7 @@ export function conductorLedgerLoadabilitySection(legacyConductor) {
         return {
             ...base,
             status: "degraded",
-            detail: "ledger loadability could not be derived (the conductor doctor was not collected)",
+            detail: "ledger loadability could not be derived (the epic-implementer doctor was not collected)",
             remediation: CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION,
         };
     }
@@ -599,7 +648,7 @@ export function conductorLedgerLoadabilitySection(legacyConductor) {
         return {
             ...base,
             status: "degraded",
-            detail: "ledger loadability could not be derived (the conductor doctor reported no native-ledger state)",
+            detail: "ledger loadability could not be derived (the epic-implementer doctor reported no native-ledger state)",
             remediation: CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION,
         };
     }

package/build/conductor/readiness.js

@@ -1,9 +1,9 @@
 /**
- * The consolidated ADVISORY conductor readiness gate (BAPI-1055, AC-6/AC-7).
+ * The consolidated ADVISORY epic-implementer readiness gate (BAPI-1055, AC-6/AC-7).
  *
  * One report that answers "is this host and repository ready to conduct an
  * epic", assembled from the five loci that each answered part of it before:
- * `bridge doctor`'s install checklist, `conductor doctor`'s local inspections,
+ * `bridge doctor`'s install checklist, `epic-implementer doctor`'s local inspections,
  * `plane` preflight, the server `conductor-readiness` collector, and the
  * install-time doctor that already composed four of them. Every prerequisite
  * comes back as a canonical {@link ReadinessCheck}: a stable id, a
@@ -77,7 +77,7 @@
  * ## Schema versioning
  *
  * {@link CONDUCTOR_READINESS_GATE_SCHEMA_VERSION} is INDEPENDENT of the install
- * doctor's section vocabulary, the conductor doctor's report, the plane
+ * doctor's section vocabulary, the epic-implementer doctor's report, the plane
  * diagnostic shape, and the Python wire response. Each of those evolves for its
  * own reasons; binding this report's version to any of them would make an
  * unrelated additive change look like a breaking one here, or worse, hide a real
@@ -87,6 +87,8 @@ import { mapConductorDoctorReportToReadinessChecks, } from "./doctor.js";
 import { mapInstallStatusChecksToReadinessChecks, } from "../install-doctor.js";
 import { mapPlanePreflightToReadinessChecks, } from "../plane/preflight.js";
 import { runConductorInstallDoctor, } from "./install-doctor.js";
+import { BRING_UP_SECTION_LABELS } from "./readiness-sections.js";
+import { classifyBringUpFacts } from "./bring-up-facts.js";
 import { createReadinessCheck, createReadinessCheckSafely, summarizeReadinessChecks, validateReadinessChecks, } from "../readiness-check.js";
 /** This report's own schema version. See the module docstring. */
 export const CONDUCTOR_READINESS_GATE_SCHEMA_VERSION = 1;
@@ -108,6 +110,15 @@ export const SERVER_READINESS_DESCRIPTORS = [
     { id: "review-policy", label: "Review policy" },
     { id: "github-credentials", label: "GitHub App credentials" },
     { id: "github-actions-permission", label: "GitHub App actions permission" },
+    // BAPI-1153 — the "Bring-up safety" group: deployment-wide facts that decide
+    // whether a plane can drive a run at all, ahead of the repository-scoped
+    // reconciler/executor rows. Labels come from the shared section layer.
+    { id: "database-migration-current", label: BRING_UP_SECTION_LABELS["database-migration-current"] },
+    { id: "worker-present", label: BRING_UP_SECTION_LABELS["worker-present"] },
+    {
+        id: "single-transition-authority",
+        label: BRING_UP_SECTION_LABELS["single-transition-authority"],
+    },
     { id: "reconciler-liveness", label: "Reconciler tick liveness" },
     { id: "executor-readiness", label: "Executor server observation" },
     { id: "review-workflow", label: "Review workflow protocol" },
@@ -150,7 +161,7 @@ const SERVER_REMEDIATIONS = {
     actionsProbeFailed: "re-run once credentials resolve; the permission could not be checked, which is not the same as confirmed-missing.",
     actionsMissing: "grant the GitHub App `actions: write`; without it the conductor's workflow rerun lane fails open on 403.",
     reconcilerUnreadable: "retry once the Bridge API is reachable; reconciler liveness is unknown here, not confirmed stale.",
-    reconcilerStale: "start the reconciler for this repository (the `conductor epic-tick` schedule) so ticks resume.",
+    reconcilerStale: "start the reconciler for this repository (the `epic-implementer epic-tick` schedule) so ticks resume.",
     executorUnreadable: "retry once the Bridge API is reachable; no executor readiness claim is ever made from local state.",
     executorNeverSeen: "provision and start an executor (`install conductor --executor-id <id>` or `executor install-service`); readiness comes only from a live server observation.",
     executorStale: "restart the executor service; it was observed once and has gone quiet past the server's staleness threshold.",
@@ -161,7 +172,7 @@ const SERVER_REMEDIATIONS = {
     olderServer: "upgrade the Bridge API deploy so it reports this fact; its state is unknown here, not healthy.",
     // BAPI-1102. Each names the ONE action that clears it, and none of them
     // mentions a webhook URL, a destination, or any configuration value.
-    unattendedConsent: "set `unattended_conductor_allowed` for this repository (docs/claude/account-settings-operator-runbook.md), or run setup with --attended.",
+    unattendedConsent: "set `unattended_epic_implementer_allowed` for this repository (docs/claude/account-settings-operator-runbook.md), or run setup with --attended.",
     unattendedNotifyDefault: "supply a --policy-file declaring notify.webhook_url, or run setup with --attended; an unattended run must have a working escalation channel, and notify.local_sink is not one.",
     repositoryWorkflowReadiness: "run `install-bridge conductor` so the review and conductor-CI workflows are confirmed on the default branch, or run setup with --attended.",
 };
@@ -268,6 +279,7 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
             remediation: SERVER_REMEDIATIONS.githubCredentials,
         });
     outcomes.push(githubActionsOutcome(readiness));
+    outcomes.push(...bringUpOutcomes(readiness));
     outcomes.push(reconcilerOutcome(readiness));
     outcomes.push(executorOutcome(readiness));
     outcomes.push(reviewWorkflowOutcome(readiness));
@@ -298,6 +310,25 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
         });
     });
 }
+/**
+ * The three BAPI-1153 bring-up safety rows.
+ *
+ * Read from the SAME classification the install doctor's sections and the
+ * `setup-epic` refusal read (`bring-up-facts.ts`), so the advisory gate cannot
+ * call a fact healthy that setup-epic refuses. Every non-`ok` verdict is `fail`:
+ * unreported and unreadable are never healthy, and the remediation already
+ * separates "retry — unknown" from "confirmed bad — do this".
+ */
+function bringUpOutcomes(readiness) {
+    return classifyBringUpFacts(readiness.bring_up ?? null).map((verdict) => verdict.state === "ok"
+        ? { id: verdict.id, status: "pass", detail: verdict.detail }
+        : {
+            id: verdict.id,
+            status: "fail",
+            detail: verdict.detail,
+            remediation: verdict.remediation ?? SERVER_REMEDIATIONS.olderServer,
+        });
+}
 /**
  * The three BAPI-1102 unattended prerequisite rows.
  *
@@ -338,7 +369,7 @@ function unattendedOutcomes(readiness) {
             : {
                 id: "unattended-consent",
                 status: "warn",
-                detail: "unattended_conductor_allowed is NOT set — an unattended run will be refused before it is created",
+                detail: "unattended_epic_implementer_allowed is NOT set — an unattended run will be refused before it is created",
                 remediation: SERVER_REMEDIATIONS.unattendedConsent,
             },
         u.notify_webhook_default_declared