@bridge_gpt/mcp-server 0.2.54 → 0.2.55

package/build/conductor/recovery-cli.js

@@ -1,20 +1,27 @@
 /**
- * `conductor` operator recovery verbs (BAPI-872): `stop-run`, `abandon-run`,
- * `unpark`, `adopt-current-head-and-unpark`.
+ * `conductor` operator recovery and repair verbs — seven CLI-only commands.
+ *
+ * The four BAPI-872 recovery verbs: `stop-run`, `abandon-run`, `unpark`,
+ * `adopt-current-head-and-unpark`. The three BAPI-1154 run-addressed repair
+ * verbs: `scope-reparse`, `dispatch-remediation`, `merge-child`.
  *
  * CLI-only by design — this is an explicit ticket non-goal, not an oversight:
- * none of these four command names is ever registered as an MCP tool, tool
+ * none of these seven command names is ever registered as an MCP tool, tool
  * description, or generated tool-schema input (`index-static.test.ts` guards
  * this). They exist so an operator (or `plane down`, via
  * `recovery-operations.ts`) can recover a stuck run or ticket WITHOUT
- * hand-rolling an HTTP request — the exact thing setup-epic's old raw-PATCH
- * guidance used to ask for.
+ * hand-rolling an HTTP request, a DAL call, or a code edit.
  *
  * Every ticket command's `row_version` CAS handling is entirely internal to
  * `recovery-operations.ts`. This surface never accepts, echoes, or asks the
- * operator for a version counter — see {@link REJECTED_VERSION_FLAGS}.
+ * operator for a version counter — see {@link REJECTED_VERSION_FLAGS}. Every
+ * repair verb takes a mandatory `--epic-run-id`; the SERVER decides whether its
+ * target belongs to that run, and a foreign target is refused with nothing
+ * written on either side.
  */
+import { readFile } from "node:fs/promises";
 import { ConductorValidationError, toConductorErrorEnvelope } from "./errors.js";
+import { DRIVER_CONTEXT_MAX_BYTES } from "./repair-contract.js";
 // ---------------------------------------------------------------------------
 // Flag parsing
 // ---------------------------------------------------------------------------
@@ -63,6 +70,11 @@ function tokenizeRecoveryFlags(argv, valueFlags, boolFlags) {
         if (!valueFlags.has(name)) {
             throw new ConductorValidationError(`Unknown flag "${name}".`);
         }
+        if (values.has(name)) {
+            // A repeated flag is ambiguous — which value did the operator mean? Refused
+            // before the second value is read rather than silently keeping the last one.
+            throw new ConductorValidationError(`Flag "${name}" may be given only once.`);
+        }
         let value;
         if (eq >= 0) {
             value = token.slice(eq + 1);
@@ -137,7 +149,7 @@ async function resolveRecoveryAccess(json) {
 // stop-run
 // ---------------------------------------------------------------------------
 const STOP_RUN_USAGE = [
-    "Usage: conductor stop-run --epic-run-id <id> [--json]",
+    "Usage: epic-implementer stop-run --epic-run-id <id> [--json]",
     "",
     "Stop an epic run: block new dispatch and cancel its queued work. The run",
     "record is preserved (never deleted) so its history stays inspectable.",
@@ -187,7 +199,7 @@ export async function runStopRunCommand(argv) {
 // abandon-run
 // ---------------------------------------------------------------------------
 const ABANDON_RUN_USAGE = [
-    "Usage: conductor abandon-run --epic-run-id <id> [--json]",
+    "Usage: epic-implementer abandon-run --epic-run-id <id> [--json]",
     "",
     "Abandon an epic run — a TERMINAL, IRREVERSIBLE transition. An abandoned run",
     "can never resume or be reused; start a new run instead. Idempotent —",
@@ -232,14 +244,14 @@ export async function runAbandonRunCommand(argv) {
 // unpark / adopt-current-head-and-unpark (shared rendering)
 // ---------------------------------------------------------------------------
 const UNPARK_USAGE = [
-    "Usage: conductor unpark --epic-run-id <id> --ticket-key <key> [--json]",
+    "Usage: epic-implementer unpark --epic-run-id <id> --ticket-key <key> [--json]",
     "",
     "Move a parked (needs_human) ticket back into its gate machine, once the",
     "operator has resolved what parked it. Retries a bounded number of times on",
     "its own if the ticket changes concurrently — never accepts a version counter.",
 ].join("\n");
 const ADOPT_CURRENT_HEAD_USAGE = [
-    "Usage: conductor adopt-current-head-and-unpark --epic-run-id <id> --ticket-key <key> [--json]",
+    "Usage: epic-implementer adopt-current-head-and-unpark --epic-run-id <id> --ticket-key <key> [--json]",
     "",
     "Recover a ticket parked because a human/external push drifted the PR head",
     "off its anchored commit: adopt the CURRENT PR head and unpark in one step.",
@@ -311,3 +323,270 @@ export async function runAdoptCurrentHeadAndUnparkCommand(argv) {
         return 1;
     }
 }
+// ---------------------------------------------------------------------------
+// BAPI-1154 — repair verbs: scope-reparse, dispatch-remediation, merge-child
+// ---------------------------------------------------------------------------
+const SCOPE_REPARSE_VALUE_FLAGS = new Set(["--epic-run-id", "--scope-id"]);
+const DISPATCH_REMEDIATION_VALUE_FLAGS = new Set([
+    "--epic-run-id",
+    "--ticket-key",
+    "--context-file",
+]);
+const MERGE_CHILD_VALUE_FLAGS = new Set(["--epic-run-id", "--pr"]);
+function requireFlag(values, flag) {
+    const value = values.get(flag);
+    if (value === undefined || value.trim().length === 0) {
+        throw new ConductorValidationError(`Flag "${flag}" is required and must be non-empty.`);
+    }
+    return value.trim();
+}
+export function parseScopeReparseArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, SCOPE_REPARSE_VALUE_FLAGS, RECOVERY_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return { epicRunId: "", scopeId: "", json: bools.has("--json"), help: true };
+    }
+    return {
+        epicRunId: requireFlag(values, "--epic-run-id"),
+        scopeId: requireFlag(values, "--scope-id"),
+        json: bools.has("--json"),
+        help: false,
+    };
+}
+export function parseDispatchRemediationArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, DISPATCH_REMEDIATION_VALUE_FLAGS, RECOVERY_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return { epicRunId: "", ticketKey: "", contextFile: "", json: bools.has("--json"), help: true };
+    }
+    return {
+        epicRunId: requireFlag(values, "--epic-run-id"),
+        ticketKey: requireFlag(values, "--ticket-key"),
+        contextFile: requireFlag(values, "--context-file"),
+        json: bools.has("--json"),
+        help: false,
+    };
+}
+export function parseMergeChildArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, MERGE_CHILD_VALUE_FLAGS, RECOVERY_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return { epicRunId: "", prNumber: 0, json: bools.has("--json"), help: true };
+    }
+    const epicRunId = requireFlag(values, "--epic-run-id");
+    const rawPr = requireFlag(values, "--pr");
+    const prNumber = /^[1-9][0-9]*$/.test(rawPr) ? Number(rawPr) : NaN;
+    if (!Number.isSafeInteger(prNumber)) {
+        throw new ConductorValidationError('Flag "--pr" must be a positive integer pull-request number.');
+    }
+    return { epicRunId, prNumber, json: bools.has("--json"), help: false };
+}
+/**
+ * Validate and decode a driver-context file's BYTES.
+ *
+ * Checked in the order that keeps a rejected file from being decoded, resolved
+ * against credentials, or transmitted: the byte length first (against the SAME
+ * `DRIVER_CONTEXT_MAX_BYTES` the server enforces), then a FATAL UTF-8 decode, then
+ * non-whitespace content. Every error names the constraint and never echoes the
+ * file's content. Over-cap context is rejected, never truncated.
+ */
+export function decodeDriverContextFile(bytes) {
+    if (bytes.byteLength > DRIVER_CONTEXT_MAX_BYTES) {
+        throw new ConductorValidationError(`--context-file is ${bytes.byteLength} bytes, over DRIVER_CONTEXT_MAX_BYTES ` +
+            `(${DRIVER_CONTEXT_MAX_BYTES} UTF-8 bytes). Shorten it and retry; nothing was sent.`);
+    }
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new ConductorValidationError("--context-file must be valid UTF-8 text; nothing was sent.");
+    }
+    if (text.trim().length === 0) {
+        throw new ConductorValidationError("--context-file is empty or whitespace-only; driver context must say something. " +
+            "Nothing was sent.");
+    }
+    return text;
+}
+/**
+ * Render a repair outcome. Human mode prints the verb and run first, the target
+ * second, ONE labeled `Before → After` pair third, then `committed` and `event
+ * recorded` — a replay is a successful no-op (`committed: false`), never a
+ * refusal. `--json` prints the server's bounded result object exactly, or a
+ * bounded `{ok:false, kind, code, message}` failure. Nothing here can print a
+ * prompt, driver context, row version, action key, head SHA, or credential: the
+ * results carry none of them.
+ */
+function renderRepairResult(outcome, input, json, extraLines = () => []) {
+    if (outcome.ok && outcome.result.committed && !outcome.result.event_recorded) {
+        // The ONE warning, and only for a committed action. A replay records nothing
+        // by design, so it never warns.
+        console.error(`Warning: ${input.verb} on run ${input.epicRunId} (${input.targetLabel}) COMMITTED, ` +
+            "but its operator_verb_applied audit event was not recorded. The action stands " +
+            "and is not rolled back. You ran it, so you own reconciling the missing audit " +
+            "record (the server also reported it to Sentry).");
+    }
+    if (json) {
+        if (outcome.ok) {
+            console.log(JSON.stringify(outcome.result));
+            return 0;
+        }
+        console.log(JSON.stringify(outcome.kind === "refused"
+            ? { ok: false, kind: "refused", code: outcome.code, message: outcome.message }
+            : { ok: false, kind: "unavailable", message: outcome.message }));
+        return 1;
+    }
+    if (!outcome.ok) {
+        if (outcome.kind === "refused") {
+            console.error(`Error: ${input.verb} refused on run ${input.epicRunId} (${input.targetLabel}) — ` +
+                `${outcome.code}: ${outcome.message}`);
+        }
+        else {
+            console.error(`Error: ${input.verb} could not complete on run ${input.epicRunId} ` +
+                `(${input.targetLabel}) — ${outcome.message}.`);
+        }
+        return 1;
+    }
+    const result = outcome.result;
+    const lines = [
+        `${input.verb} — run ${input.epicRunId}`,
+        `  target:          ${input.targetLabel}`,
+        `  ${input.stateLabel}: ${result.before ?? "none"} → ${result.after ?? "none"}`,
+        ...extraLines(result),
+        `  committed:       ${result.committed}${result.committed ? "" : " (already in this state; no change made)"}`,
+        `  event recorded:  ${result.event_recorded}`,
+    ];
+    console.log(lines.join("\n"));
+    return 0;
+}
+const SCOPE_REPARSE_USAGE = [
+    "Usage: epic-implementer scope-reparse --epic-run-id <id> --scope-id <scope> [--json]",
+    "",
+    "Re-drive the run's OWN index scope through the retry-reparse lifecycle and",
+    "schedule its parse. The scope must be the one bound to the named run, or the",
+    "server refuses it (TICKET_NOT_IN_RUN) with nothing written. Prints the scope",
+    "lifecycle before → after; it does not wait for the parse to finish.",
+].join("\n");
+export async function runScopeReparseCommand(argv) {
+    try {
+        const parsed = parseScopeReparseArgs(argv);
+        if (parsed.help) {
+            console.log(SCOPE_REPARSE_USAGE);
+            return 0;
+        }
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { scopeReparseRepair } = await import("./recovery-operations.js");
+        const outcome = await scopeReparseRepair(access, {
+            epicRunId: parsed.epicRunId,
+            scopeId: parsed.scopeId,
+        });
+        return renderRepairResult(outcome, {
+            verb: "scope-reparse",
+            epicRunId: parsed.epicRunId,
+            targetLabel: `scope ${parsed.scopeId}`,
+            stateLabel: "scope lifecycle",
+        }, parsed.json, (result) => [
+            `  outcome:         ${result.outcome}${result.parse_scheduled ? " (parse scheduled)" : ""}`,
+        ]);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}
+const DISPATCH_REMEDIATION_USAGE = [
+    "Usage: epic-implementer dispatch-remediation --epic-run-id <id> --ticket-key <key> --context-file <path> [--json]",
+    "",
+    "Dispatch a remediation job for a ticket at code_review (or parked there),",
+    "carrying your driver context to the worker. The SERVER chooses the job type",
+    "(remediate, or reconcile_overlap for a conflict/overlap ticket) and admits it",
+    "through the reconciler's own strict-serial lane, remediation budget, and",
+    "dedup key. A parked ticket is resumed in the same step.",
+    "",
+    `--context-file must be non-empty UTF-8 text of at most DRIVER_CONTEXT_MAX_BYTES`,
+    `(${DRIVER_CONTEXT_MAX_BYTES} bytes). It is rejected, never truncated, and is never`,
+    "printed, logged, or echoed — it reaches only the worker's prompt.",
+].join("\n");
+export async function runDispatchRemediationCommand(argv, deps = {}) {
+    try {
+        const parsed = parseDispatchRemediationArgs(argv);
+        if (parsed.help) {
+            console.log(DISPATCH_REMEDIATION_USAGE);
+            return 0;
+        }
+        // Read and validate the context BEFORE credentials are resolved or the HTTP
+        // graph is loaded, so an invalid file costs nothing and reaches no one.
+        let bytes;
+        try {
+            bytes = await (deps.readFile ?? ((p) => readFile(p)))(parsed.contextFile);
+        }
+        catch {
+            throw new ConductorValidationError("--context-file could not be read; nothing was sent.");
+        }
+        const context = decodeDriverContextFile(bytes);
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { dispatchRemediationRepair } = await import("./recovery-operations.js");
+        const outcome = await dispatchRemediationRepair(access, {
+            epicRunId: parsed.epicRunId,
+            ticketKey: parsed.ticketKey,
+            context,
+        });
+        return renderRepairResult(outcome, {
+            verb: "dispatch-remediation",
+            epicRunId: parsed.epicRunId,
+            targetLabel: `ticket ${parsed.ticketKey}`,
+            stateLabel: "code_review gate",
+        }, parsed.json, (result) => [
+            `  job:             ${result.job_type || "unknown"}${result.job_id !== null ? ` (job ${result.job_id})` : ""}`,
+        ]);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}
+const MERGE_CHILD_USAGE = [
+    "Usage: epic-implementer merge-child --epic-run-id <id> --pr <number> [--json]",
+    "",
+    "Merge the run's child pull request through the shared merge service. You give",
+    "ONLY the PR number: the server finds the one ticket in the run bound to it",
+    "(or refuses, TICKET_NOT_IN_RUN, with nothing written) and composes the head",
+    "commit and gate identity itself. Every merge guard applies, and a merge",
+    "advances the run's scope on the same path as the MCP merge tool. A PR that is",
+    "already merged is a successful no-op.",
+    "",
+    "When the repository merges locally (the default), your own `gh` performs the",
+    "merge — run this from inside the repository's checkout, with `gh auth status`",
+    "passing.",
+].join("\n");
+export async function runMergeChildCommand(argv) {
+    try {
+        const parsed = parseMergeChildArgs(argv);
+        if (parsed.help) {
+            console.log(MERGE_CHILD_USAGE);
+            return 0;
+        }
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { mergeChildRepair } = await import("./recovery-operations.js");
+        const outcome = await mergeChildRepair(access, {
+            epicRunId: parsed.epicRunId,
+            prNumber: parsed.prNumber,
+        });
+        return renderRepairResult(outcome, {
+            verb: "merge-child",
+            epicRunId: parsed.epicRunId,
+            targetLabel: `PR #${parsed.prNumber}`,
+            stateLabel: "merge",
+        }, parsed.json, (result) => [
+            ...(result.ticket_key ? [`  ticket:          ${result.ticket_key}`] : []),
+            ...(result.reason ? [`  reason:          ${result.reason}`] : []),
+        ]);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}

package/build/conductor/recovery-operations.js

@@ -1,7 +1,9 @@
 /**
  * Shared Bridge API operator-recovery operations (BAPI-872).
  *
- * Centralizes stop, abandon, and ticket unpark/adopt-current-head-and-unpark so
+ * Centralizes stop, abandon, ticket unpark/adopt-current-head-and-unpark, and
+ * (BAPI-1154) the three run-addressed repair verbs — scope-reparse,
+ * dispatch-remediation, merge-child — so
  * the conductor CLI recovery verbs (`recovery-cli.ts`) and `plane down`
  * (`../plane/shutdown.ts`, wired through `../plane/cli.ts`) share EXACTLY the
  * same stop semantics, and so this module — never a caller — owns every
@@ -15,7 +17,9 @@
  * callers: `recovery-cli.ts` and `plane/shutdown.ts`.
  */
 import { randomUUID } from "crypto";
-import { adoptCurrentHeadAndUnparkTicket, ConductorBridgeApiError, fetchEpicRunState, safeDiagnosticMessage, stopEpicRun, unparkEpicTicket, updateEpicRunStatus, } from "./bridge-api-client.js";
+import { adoptCurrentHeadAndUnparkTicket, completeMergeChild, ConductorBridgeApiError, dispatchRemediation, fetchEpicRunState, mergeChild, safeDiagnosticMessage, scopeReparse, stopEpicRun, unparkEpicTicket, updateEpicRunStatus, } from "./bridge-api-client.js";
+import { DEFAULT_GATE_NAME } from "./git-ci-types.js";
+import { resolveLocalMergeMethod, runApprovedLocalMerge } from "./local-merge.js";
 /**
  * Bounded total attempts for a ticket-recovery CAS retry loop. Each attempt
  * begins with a fresh, authoritative state read — so this bounds full
@@ -217,3 +221,122 @@ export async function unparkEpicTicketWithRetry(access, options) {
 export async function adoptCurrentHeadAndUnparkWithRetry(access, options) {
     return ticketRecoveryWithRetry(access, options, (a, args) => adoptCurrentHeadAndUnparkTicket(a, args));
 }
+/**
+ * Classify a thrown client error. A 4xx carrying a server `error_code` is a
+ * NAMED refusal and keeps that code; everything else (transport, timeout, 5xx
+ * without a code, an unparseable body) is `unavailable` with a bounded
+ * diagnostic. No raw body, URL, header, or credential ever reaches either shape.
+ */
+function classifyRepairError(err, fallback) {
+    if (err instanceof ConductorBridgeApiError && typeof err.status === "number" && err.errorCode) {
+        return {
+            ok: false,
+            kind: "refused",
+            code: err.errorCode,
+            status: err.status,
+            message: err.bodyPreview ?? err.errorCode,
+        };
+    }
+    return { ok: false, kind: "unavailable", message: safeDiagnosticMessage(err, fallback) };
+}
+/** Re-drive the run's own index scope. The server decides ownership. */
+export async function scopeReparseRepair(access, options, deps = {}) {
+    try {
+        const call = deps.scopeReparse ?? scopeReparse;
+        return { ok: true, result: await call(access, options) };
+    }
+    catch (err) {
+        return classifyRepairError(err, "scope-reparse request failed");
+    }
+}
+/**
+ * Dispatch a remediation job with driver context. `context` must already be
+ * validated against `DRIVER_CONTEXT_MAX_BYTES`; the server selects the job type.
+ */
+export async function dispatchRemediationRepair(access, options, deps = {}) {
+    try {
+        const call = deps.dispatchRemediation ?? dispatchRemediation;
+        return { ok: true, result: await call(access, options) };
+    }
+    catch (err) {
+        return classifyRepairError(err, "dispatch-remediation request failed");
+    }
+}
+/** A local failure reason is forwarded only when it is a bounded token. */
+const LOCAL_MERGE_REASON_RE = /^[a-z0-9_.:-]{1,200}$/;
+function boundedLocalMergeReason(reason) {
+    return typeof reason === "string" && LOCAL_MERGE_REASON_RE.test(reason)
+        ? reason
+        : "gh_merge_failed";
+}
+/**
+ * Merge the run's PR-bound child. The operator supplies only the PR number.
+ *
+ * When the server merges (repository `merge_execution = server`) its answer is
+ * final. When the repository merges locally — the default, and the only mode
+ * that works on an App without `contents: write` — the server returns an
+ * approval, this operation executes it with the operator's own `gh` through the
+ * SAME `runApprovedLocalMerge` the MCP merge tool uses (head-drift guard,
+ * `--match-head-commit`, and the ambiguity ladder included), and reports what
+ * `gh` did to the completion route, whose answer is the result. The approval's
+ * head SHA is consumed here and never returned or printed.
+ */
+export async function mergeChildRepair(access, options, deps = {}) {
+    let approval;
+    try {
+        approval = await (deps.mergeChild ?? mergeChild)(access, options);
+    }
+    catch (err) {
+        return classifyRepairError(err, "merge-child request failed");
+    }
+    const { local_execution: local, ...serverResult } = approval;
+    if (local === null) {
+        return { ok: true, result: serverResult };
+    }
+    const runLocal = deps.runLocalMerge ?? runApprovedLocalMerge;
+    let succeeded = false;
+    let alreadyMerged = false;
+    let failureReason = "gh_merge_failed";
+    try {
+        const localResult = await runLocal({
+            repo_name: access.repoName,
+            pr_number: options.prNumber,
+            expected_head_sha: local.expected_head_sha,
+            gate: { name: DEFAULT_GATE_NAME },
+            // A correlation label for the local executor's own in-memory evidence,
+            // which is discarded — never the server's action key, which the server
+            // recomposes itself at completion.
+            action_key: `merge-child:${options.epicRunId}:${options.prNumber}`,
+        }, { method: resolveLocalMergeMethod(local.merge_method) }, { env: deps.env ?? process.env });
+        succeeded = localResult.status === "succeeded";
+        alreadyMerged = succeeded && localResult.reason === "already_merged";
+        failureReason = boundedLocalMergeReason(localResult.reason);
+    }
+    catch {
+        succeeded = false;
+    }
+    try {
+        const completion = await (deps.completeMergeChild ?? completeMergeChild)(access, {
+            epicRunId: options.epicRunId,
+            prNumber: options.prNumber,
+            result: succeeded ? (alreadyMerged ? "already_merged" : "merged") : "failed",
+            ...(succeeded ? {} : { reason: failureReason }),
+        });
+        const { local_execution: _ignored, ...completed } = completion;
+        return { ok: true, result: completed };
+    }
+    catch (err) {
+        if (succeeded) {
+            // The merge is REAL whether or not the report landed. Reporting a failure
+            // here would invite a second merge attempt on a merged pull request.
+            return {
+                ok: false,
+                kind: "unavailable",
+                message: "the pull request was merged by your local gh, but the server could not record it " +
+                    `(${safeDiagnosticMessage(err, "completion request failed")}); re-run merge-child ` +
+                    "to record it — a merged pull request is answered as already_merged",
+            };
+        }
+        return classifyRepairError(err, "merge-child completion failed");
+    }
+}

package/build/conductor/repair-contract.js

@@ -0,0 +1,58 @@
+/**
+ * The shared contract for the run-addressed operator repair verbs (BAPI-1154):
+ * `scope-reparse`, `dispatch-remediation`, and `merge-child`.
+ *
+ * CLI-only, exactly like the BAPI-872 recovery verbs: none of these names is ever
+ * registered as an MCP tool (`index-static.test.ts` pins that). This module is the
+ * TypeScript mirror of `api/library/epic_conductor/operator_repair_contract.py` —
+ * the verb names, the CLOSED refusal-code table, the driver-context byte cap, and
+ * the bounded result shapes the Bridge client returns. A parity test keeps the two
+ * aligned; the CLI renders the server's code and never infers ownership or state
+ * from error prose.
+ *
+ * `release-job` is deliberately absent: its defect was already fixed by BAPI-1147
+ * and the executor's per-job timeout bounds any residual strand.
+ */
+export const VERB_SCOPE_REPARSE = "scope-reparse";
+export const VERB_DISPATCH_REMEDIATION = "dispatch-remediation";
+export const VERB_MERGE_CHILD = "merge-child";
+/** Every repair verb, in the order an operator meets them. */
+export const OPERATOR_REPAIR_VERBS = [
+    VERB_SCOPE_REPARSE,
+    VERB_DISPATCH_REMEDIATION,
+    VERB_MERGE_CHILD,
+];
+/**
+ * The ONE cap on driver context, in UTF-8 BYTES — the same number the server
+ * enforces (`DRIVER_CONTEXT_MAX_BYTES` in `prompt_specs.py`). Over-cap context is
+ * rejected before it is transmitted, never truncated: a code-changing worker must
+ * see the operator's complete instruction or none of it.
+ */
+export const DRIVER_CONTEXT_MAX_BYTES = 16384;
+/** The closed refusal-code vocabulary, mirroring the server table. */
+export const OPERATOR_REPAIR_REFUSAL_CODES = [
+    "TICKET_NOT_IN_RUN",
+    "DRIVER_CONTEXT_INVALID",
+    "RUN_NOT_DISPATCHABLE",
+    "TICKET_NOT_REMEDIABLE",
+    "MERGE_HELD_BEHIND_PEER",
+    "REMEDIATION_JOB_IN_FLIGHT",
+    "REMEDIATION_LANE_BUSY",
+    "REMEDIATION_BUDGET_EXHAUSTED",
+    "REMEDIATION_HELD",
+    "REMEDIATION_CONTRACT_ERROR",
+    "REMEDIATION_NO_PULL_REQUEST",
+    "ROW_VERSION_CONFLICT",
+    "DISPATCH_ENQUEUE_FAILED",
+    "SCOPE_REPARSE_REFUSED",
+    "SCOPE_LOOKUP_FAILED",
+    "MERGE_HEAD_UNBOUND",
+    "MERGE_GATE_UNRESOLVABLE",
+    "MERGE_NOT_COMPLETED",
+    "MERGE_COMPLETION_REFUSED",
+];
+/** True when `code` is one of the closed repair refusal codes. */
+export function isOperatorRepairRefusalCode(code) {
+    return (typeof code === "string" &&
+        OPERATOR_REPAIR_REFUSAL_CODES.includes(code));
+}

package/build/conductor/store.js

@@ -334,7 +334,7 @@ function buildAuxiliaryTablesSql() {
     );
 
     -- The supervisor projection is actively maintained by the conductor
-    -- supervisor runtime (BAPI-396, \`conductor supervise --run-id <id>\`): the
+    -- supervisor runtime (BAPI-396, \`epic-implementer supervise --run-id <id>\`): the
     -- foreground loop upserts a row after every deterministic iteration. It is
     -- the OPERATIONAL state mirror of the run; raw events remain the source of
     -- truth. The existing JSON columns are sufficient for resumable state, so the
@@ -822,7 +822,7 @@ export function rowToSupervisorProjection(row) {
  * Read the supervisor projection for `run_id` (read-only). Returns
  * `{ run_id, status: "unknown", projection: null }` when no projection exists.
  * The projection is maintained by the conductor supervisor runtime
- * (`conductor supervise`); this read never derives state from raw events.
+ * (`epic-implementer supervise`); this read never derives state from raw events.
  */
 export async function getSupervisorSnapshot(runId, config = resolveConductorStoreConfig()) {
     const db = await openReadonlyConductorDatabaseIfExists(config);

package/build/conductor/supervisor-runtime.js

@@ -1,7 +1,7 @@
 /**
  * Foreground supervisor runtime loop (BAPI-396, conductor C4).
  *
- * `conductor supervise --run-id <id>` runs this run-scoped, visible, ephemeral
+ * `epic-implementer supervise --run-id <id>` runs this run-scoped, visible, ephemeral
  * loop. It polls the conductor ledger, reduces raw events into deterministic
  * worker watchdog state, persists an operational projection, escalates stuck
  * workers (terminal output + idempotent ledger event), and terminates when all