@bridge_gpt/mcp-server 0.2.57 → 0.2.59

package/build/conductor/install-doctor.js

@@ -36,7 +36,7 @@ import { buildConductorDoctorReport, formatConductorDoctorReport, } from "./doct
 import { inspectBridgeApiProfileToken, } from "../mcp-host-config.js";
 import { collectExecutorServiceDiagnostics, formatExecutorServiceDiagnosticsReport, } from "../doctor.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, } from "../install-doctor.js";
-import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, conductorProfileTokenSection, CONDUCTOR_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
+import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, conductorProfileTokenSection, EPIC_IMPLEMENTER_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
 import { ConductorBridgeApiError, fetchConductorReadiness, } from "./bridge-api-client.js";
 /**
  * Run one optional collector, containing any throw.
@@ -86,8 +86,8 @@ export async function runConductorInstallDoctor(deps) {
     const legacyConductor = conductorSettled.value ?? null;
     if (conductorSettled.failed) {
         sections.push({
-            id: "conductor-ledger",
-            label: "Conductor ledger doctor",
+            id: "epic-implementer-ledger",
+            label: "Epic Implementer ledger doctor",
             status: "degraded",
             detail: "the local epic-implementer doctor could not be built",
             remediation: "run `epic-implementer doctor` directly to see why the local ledger report failed.",
@@ -219,7 +219,7 @@ export async function runConductorInstallDoctor(deps) {
         }));
     let profileToken = null;
     try {
-        profileToken = await inspectProfile(deps.projectRoot ?? process.cwd(), CONDUCTOR_PROFILE_TOKEN);
+        profileToken = await inspectProfile(deps.projectRoot ?? process.cwd(), EPIC_IMPLEMENTER_PROFILE_TOKEN);
     }
     catch {
         // The shared inspector never throws for the ordinary absent/malformed
@@ -285,7 +285,7 @@ export function formatConductorInstallDoctorReport(report) {
         embed("Bridge install status", () => formatInstallStatusReport(report.legacyInstallChecks));
     }
     if (report.legacyConductor) {
-        embed("Conductor ledger doctor", () => formatConductorDoctorReport(report.legacyConductor));
+        embed("Epic Implementer ledger doctor", () => formatConductorDoctorReport(report.legacyConductor));
     }
     if (report.legacyExecutorPreflight) {
         const p = report.legacyExecutorPreflight;
@@ -335,6 +335,6 @@ export function conductorInstallDoctorHasFatal(report) {
 // remediation constants, or the installer reporting APIs from
 // `conductor/install-doctor.js` keeps resolving exactly as before.
 // ---------------------------------------------------------------------------
-export { BRING_UP_SECTION_LABELS, bringUpSafetySections, databaseMigrationCurrentSection, singleTransitionAuthoritySection, workerPresentSection, CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, CONDUCTOR_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, } from "./readiness-sections.js";
+export { BRING_UP_SECTION_LABELS, bringUpSafetySections, databaseMigrationCurrentSection, singleTransitionAuthoritySection, workerPresentSection, CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, EPIC_IMPLEMENTER_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, } from "./readiness-sections.js";
 // BAPI-1153 — the bring-up remediations the three sections above render.
 export { BRING_UP_RUNBOOK, BRING_UP_UNREPORTED_REMEDIATION, DATABASE_MIGRATION_BEHIND_REMEDIATION, DATABASE_MIGRATION_UNREADABLE_REMEDIATION, SECOND_RECONCILER_REMEDIATION, WORKER_HEARTBEAT_UNREADABLE_REMEDIATION, WORKER_NOT_PRESENT_REMEDIATION, } from "./bring-up-facts.js";

package/build/conductor/merge-ledger.js

@@ -119,11 +119,11 @@ export async function emitMergeLedgerEventIfNew(input, deps = {}) {
     const eventId = makeMergeEventId(input.type, input.action_key);
     const event = {
         id: eventId,
-        source: "conductor-supervisor",
+        source: "epic-implementer-supervisor",
         type: input.type,
         run_id: input.run_id ?? null,
         worker_id: input.worker_id ?? null,
-        producer: "conductor-merge",
+        producer: "epic-implementer-merge",
         observed_via: "supervisor",
         data: {
             summary: input.summary ?? `${input.type} ${input.action_key}`,

package/build/conductor/pr-ci-producer.js

@@ -109,7 +109,7 @@ export function buildGateMetEventInput(binding, evaluation, runId = null, worker
     if (!evaluation.met || !evaluation.gateEventData)
         return null;
     return {
-        source: "conductor",
+        source: "epic-implementer",
         type: "gate.met",
         subject: binding.subject,
         run_id: runId,
@@ -142,8 +142,8 @@ async function observeWithResolved(binding, access, gateConfig, deps, expectedBa
     const now = deps.now ?? (() => new Date().toISOString());
     // Resolve run_id/worker_id for attribution. Env takes precedence; fall back
     // to the injected resolution seam when the env identity is absent.
-    let run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
-    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    let run_id = deps.env?.BAPI_EPIC_IMPLEMENTER_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_EPIC_IMPLEMENTER_WORKER_ID?.trim() || null;
     if (run_id === null && deps.resolveRunId) {
         try {
             run_id = await deps.resolveRunId(access, binding) ?? null;
@@ -432,8 +432,8 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
     }
     // Env-stamp identity; fall back to the resolution seam when env is absent.
     // Access resolution for the seam is attempted inline within the gate block.
-    let run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
-    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    let run_id = deps.env?.BAPI_EPIC_IMPLEMENTER_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_EPIC_IMPLEMENTER_WORKER_ID?.trim() || null;
     const result = {
         binding,
         pr_opened_emitted: false,
@@ -541,7 +541,7 @@ function extractTicketKeyFromRef(headRef) {
  * any step fails — the producer never crashes on a resolution failure.
  *
  * Intended to be injected as `PrCiProducerDeps.resolveRunId` at call sites
- * that lack `BAPI_CONDUCTOR_RUN_ID` in the environment (git-hook / CI-poll
+ * that lack `BAPI_EPIC_IMPLEMENTER_RUN_ID` in the environment (git-hook / CI-poll
  * contexts). A production `fetchImpl` is optional; defaults to the global fetch.
  */
 export async function resolveDispatchRunIdForBinding(access, binding, fetchImpl = fetch) {

package/build/conductor/pr-review-producer.js

@@ -58,8 +58,8 @@ export function buildReviewObservationEventInput(binding, snapshot, eventType, r
 export async function observeReviewWithResolved(binding, access, gateConfig, deps = {}) {
     const fetchStatus = deps.fetchReviewStatus ?? fetchPrReviewStatus;
     const emitIfNew = deps.emitIfNew ?? emitConductorEventIfNew;
-    const run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
-    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    const run_id = deps.env?.BAPI_EPIC_IMPLEMENTER_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_EPIC_IMPLEMENTER_WORKER_ID?.trim() || null;
     const result = {
         snapshot: null,
         review_passed_emitted: false,

package/build/conductor/producer-ledger.js

@@ -33,6 +33,8 @@ export function makeProducerDedupeKey(dimensions) {
  * the `events.id` UNIQUE constraint instead of appending a duplicate.
  */
 export function makeStableProducerEventId(dedupeKey) {
+    // Upgrade seam: preserve the legacy namespace so retries spanning releases
+    // collide with the event ID already written before the wire-name migration.
     const h = createHash("sha256").update(`conductor-producer:${dedupeKey}`).digest("hex");
     return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }

package/build/conductor/readiness-sections.js

@@ -39,7 +39,7 @@ import { CLAUDE_REVIEW_WORKFLOW_DRIFT_REMEDIATION, summarizeClaudeReviewWorkflow
 import { describeNativeLedgerAvailability } from "./doctor.js";
 import { classifyDatabaseMigration, classifySingleTransitionAuthority, classifyWorkerPresent, } from "./bring-up-facts.js";
 /** Operator runbook pointer surfaced beside the executor gap. */
-export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-conductor-v2-operator-runbook.md";
+export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-implementer-v2-operator-runbook.md";
 /**
  * Capability-matrix guidance for the executor leg.
  *
@@ -51,13 +51,13 @@ export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-conductor-v2
 export const EXECUTOR_PROVISIONING_GUIDANCE = "`install conductor` writes the unit and starts it, each behind its own consent; " +
     "readiness still comes only from a live server observation";
 /**
- * The `BRIDGE_MCP_PROFILE` token that makes the 8 conductor MCP tools visible.
+ * The `BRIDGE_MCP_PROFILE` token that makes the 8 Epic Implementer MCP tools visible.
  *
  * The tools are profile-gated, never core, and this is the only token that
  * un-gates them — so the doctor names it explicitly rather than describing the
  * gap abstractly (BAPI-775).
  */
-export const CONDUCTOR_PROFILE_TOKEN = "conductor";
+export const EPIC_IMPLEMENTER_PROFILE_TOKEN = "epic_implementer";
 /** Remediation for a host MCP config that carries no Bridge entry at all. */
 export const CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION = "no supported host MCP config carries a Bridge entry — run " +
     `\`npx ${MCP_PACKAGE_NAME} install\` to register one, then re-run \`install conductor\`.`;
@@ -500,7 +500,7 @@ export function executorObservationSection(readiness) {
  * Whether this host looks like a conductor context.
  *
  * Composed from the two facts already collected: the resolved MCP-profile
- * inspection (`BAPI_CONDUCTOR_ENABLED` or a registered epic-tick schedule) and
+ * inspection (`BAPI_EPIC_IMPLEMENTER_ENABLED` or a registered epic-tick schedule) and
  * the read-only host token inspection. Outside such a context a missing local
  * capability is ADVISORY — reporting it as a gap would train operators of
  * ordinary repositories to ignore this whole part of the report.
@@ -522,7 +522,7 @@ export function detectConductorContext(legacyConductor, profile) {
  * that Codex or Copilot configuration was inspected or changed.
  */
 export function conductorProfileTokenSection(profile, conductorContext) {
-    const base = { id: "conductor-profile-token", label: "MCP conductor profile token" };
+    const base = { id: "epic-implementer-profile-token", label: "Epic Implementer MCP profile token" };
     if (profile === null) {
         return {
             ...base,
@@ -632,8 +632,8 @@ export function conductorHookTargetsSection(legacyConductor, conductorContext) {
  */
 export function conductorLedgerLoadabilitySection(legacyConductor) {
     const base = {
-        id: "conductor-ledger-loadability",
-        label: "Conductor ledger loadability",
+        id: "epic-implementer-ledger-loadability",
+        label: "Epic Implementer ledger loadability",
     };
     if (legacyConductor === null || legacyConductor === undefined) {
         return {

package/build/conductor/readiness.js

@@ -626,8 +626,8 @@ const INSTALL_SECTION_IDS_OWNED_ELSEWHERE = new Set([
     "server-readiness",
     "bridge-access",
     // Local conductor facts — owned by `mapConductorDoctorReportToReadinessChecks`.
-    "conductor-ledger",
-    "conductor-ledger-loadability",
+    "epic-implementer-ledger",
+    "epic-implementer-ledger-loadability",
     // Legacy embedded reports — owned by their own adapters.
     "install-status",
 ]);

package/build/conductor/recovery-cli.js

@@ -1,19 +1,21 @@
 /**
- * `conductor` operator recovery and repair verbs — seven CLI-only commands.
+ * `conductor` operator recovery and repair verbs — ten CLI-only commands.
  *
  * The four BAPI-872 recovery verbs: `stop-run`, `abandon-run`, `unpark`,
- * `adopt-current-head-and-unpark`. The three BAPI-1154 run-addressed repair
- * verbs: `scope-reparse`, `dispatch-remediation`, `merge-child`.
+ * `adopt-current-head-and-unpark`. The six run-addressed repair verbs: BAPI-1154's
+ * `scope-reparse`, `dispatch-remediation`, `merge-child`, and BAPI-1176's
+ * `scope-catch-up`, `patch-policy`, `resume-run`.
  *
  * CLI-only by design — this is an explicit ticket non-goal, not an oversight:
- * none of these seven command names is ever registered as an MCP tool, tool
+ * none of these ten command names is ever registered as an MCP tool, tool
  * description, or generated tool-schema input (`index-static.test.ts` guards
  * this). They exist so an operator (or `plane down`, via
  * `recovery-operations.ts`) can recover a stuck run or ticket WITHOUT
  * hand-rolling an HTTP request, a DAL call, or a code edit.
  *
  * Every ticket command's `row_version` CAS handling is entirely internal to
- * `recovery-operations.ts`. This surface never accepts, echoes, or asks the
+ * `recovery-operations.ts`, and `resume-run`'s control-generation CAS is entirely
+ * the server's. This surface never accepts, echoes, or asks the
  * operator for a version counter — see {@link REJECTED_VERSION_FLAGS}. Every
  * repair verb takes a mandatory `--epic-run-id`; the SERVER decides whether its
  * target belongs to that run, and a foreign target is refused with nothing
@@ -21,7 +23,7 @@
  */
 import { readFile } from "node:fs/promises";
 import { ConductorValidationError, toConductorErrorEnvelope } from "./errors.js";
-import { DRIVER_CONTEXT_MAX_BYTES } from "./repair-contract.js";
+import { DRIVER_CONTEXT_MAX_BYTES, POLICY_PATCH_MAX_BYTES } from "./repair-contract.js";
 // ---------------------------------------------------------------------------
 // Flag parsing
 // ---------------------------------------------------------------------------
@@ -32,12 +34,15 @@ const RECOVERY_BOOL_FLAGS = new Set(["--json", "--help"]);
  * Every spelling of an operator-supplied version counter this surface must
  * refuse outright (BAPI-872) — row_version handling is internal to
  * {@link module:./recovery-operations}, and no ticket command may accept one.
+ * BAPI-1176 adds the run-control generation: `resume-run`'s CAS is the server's.
  */
 const REJECTED_VERSION_FLAGS = new Set([
     "--row-version",
     "--expected-row-version",
     "--row_version",
     "--expected_row_version",
+    "--expected-generation",
+    "--expected_generation",
 ]);
 /**
  * Tokenize `--flag value` / `--flag=value` / boolean flags for the recovery
@@ -64,6 +69,10 @@ function tokenizeRecoveryFlags(argv, valueFlags, boolFlags) {
                 "current version itself.");
         }
         if (boolFlags.has(name)) {
+            if (bools.has(name)) {
+                // Refused like a repeated value flag rather than silently collapsed.
+                throw new ConductorValidationError(`Flag "${name}" may be given only once.`);
+            }
             bools.add(name);
             continue;
         }
@@ -407,12 +416,13 @@ export function decodeDriverContextFile(bytes) {
 }
 /**
  * Render a repair outcome. Human mode prints the verb and run first, the target
- * second, ONE labeled `Before → After` pair third, then `committed` and `event
- * recorded` — a replay is a successful no-op (`committed: false`), never a
- * refusal. `--json` prints the server's bounded result object exactly, or a
- * bounded `{ok:false, kind, code, message}` failure. Nothing here can print a
- * prompt, driver context, row version, action key, head SHA, or credential: the
- * results carry none of them.
+ * second, ONE labeled `Before → After` pair third, then whether this call
+ * `applied` a change or found it `already current / no change`, then `committed`
+ * and `event recorded` — a replay is a successful no-op (`committed: false`),
+ * never a refusal. `--json` prints the server's bounded result object exactly, or
+ * a bounded `{ok:false, kind, code, message}` failure. Nothing here can print a
+ * prompt, driver context, policy value, row version, generation, action key, head
+ * SHA, or credential: the results carry none of them.
  */
 function renderRepairResult(outcome, input, json, extraLines = () => []) {
     if (outcome.ok && outcome.result.committed && !outcome.result.event_recorded) {
@@ -449,6 +459,7 @@ function renderRepairResult(outcome, input, json, extraLines = () => []) {
         `${input.verb} — run ${input.epicRunId}`,
         `  target:          ${input.targetLabel}`,
         `  ${input.stateLabel}: ${result.before ?? "none"} → ${result.after ?? "none"}`,
+        `  result:          ${result.committed ? "applied" : "already current / no change"}`,
         ...extraLines(result),
         `  committed:       ${result.committed}${result.committed ? "" : " (already in this state; no change made)"}`,
         `  event recorded:  ${result.event_recorded}`,
@@ -590,3 +601,223 @@ export async function runMergeChildCommand(argv) {
         return 1;
     }
 }
+// ---------------------------------------------------------------------------
+// BAPI-1176 — repair verbs: scope-catch-up, patch-policy, resume-run
+// ---------------------------------------------------------------------------
+const SCOPE_CATCH_UP_VALUE_FLAGS = new Set(["--epic-run-id", "--scope-id"]);
+const PATCH_POLICY_VALUE_FLAGS = new Set(["--epic-run-id", "--patch-file"]);
+const RESUME_RUN_VALUE_FLAGS = new Set(["--epic-run-id"]);
+/** `--clear-quarantine` is a `resume-run` switch only; no other verb accepts it. */
+const RESUME_RUN_BOOL_FLAGS = new Set(["--json", "--help", "--clear-quarantine"]);
+export function parseScopeCatchUpArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, SCOPE_CATCH_UP_VALUE_FLAGS, RECOVERY_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return { epicRunId: "", scopeId: "", json: bools.has("--json"), help: true };
+    }
+    return {
+        epicRunId: requireFlag(values, "--epic-run-id"),
+        scopeId: requireFlag(values, "--scope-id"),
+        json: bools.has("--json"),
+        help: false,
+    };
+}
+export function parsePatchPolicyArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, PATCH_POLICY_VALUE_FLAGS, RECOVERY_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return { epicRunId: "", patchFile: "", json: bools.has("--json"), help: true };
+    }
+    return {
+        epicRunId: requireFlag(values, "--epic-run-id"),
+        patchFile: requireFlag(values, "--patch-file"),
+        json: bools.has("--json"),
+        help: false,
+    };
+}
+export function parseResumeRunArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, RESUME_RUN_VALUE_FLAGS, RESUME_RUN_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return {
+            epicRunId: "",
+            clearQuarantine: bools.has("--clear-quarantine"),
+            json: bools.has("--json"),
+            help: true,
+        };
+    }
+    return {
+        epicRunId: requireFlag(values, "--epic-run-id"),
+        clearQuarantine: bools.has("--clear-quarantine"),
+        json: bools.has("--json"),
+        help: false,
+    };
+}
+/**
+ * Validate and decode a `patch-policy` file's BYTES into a merge-patch object.
+ *
+ * Checked in the order that keeps a rejected file from being decoded, parsed,
+ * resolved against credentials, or transmitted: the raw byte length first (against
+ * the SAME `POLICY_PATCH_MAX_BYTES` the server enforces), then a FATAL UTF-8
+ * decode, then `JSON.parse`, then the shape — a non-empty JSON object. Every error
+ * names its category and never echoes the file's content. A `JSON.parse` message
+ * is never forwarded, because V8 quotes the offending text in it.
+ */
+export function decodePolicyPatchFile(bytes) {
+    if (bytes.byteLength > POLICY_PATCH_MAX_BYTES) {
+        throw new ConductorValidationError(`--patch-file is ${bytes.byteLength} bytes, over POLICY_PATCH_MAX_BYTES ` +
+            `(${POLICY_PATCH_MAX_BYTES} UTF-8 bytes). Shorten it and retry; nothing was sent.`);
+    }
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new ConductorValidationError("--patch-file must be valid UTF-8 text; nothing was sent.");
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new ConductorValidationError("--patch-file is not valid JSON; nothing was sent.");
+    }
+    if (value === null) {
+        throw new ConductorValidationError("--patch-file must hold a JSON object, not null; nothing was sent.");
+    }
+    if (Array.isArray(value)) {
+        throw new ConductorValidationError("--patch-file must hold a JSON object, not an array; nothing was sent.");
+    }
+    if (typeof value !== "object") {
+        throw new ConductorValidationError("--patch-file must hold a JSON object, not a scalar value; nothing was sent.");
+    }
+    if (Object.keys(value).length === 0) {
+        throw new ConductorValidationError("--patch-file is an empty object; a merge patch must change at least one key. " +
+            "Nothing was sent.");
+    }
+    return value;
+}
+const SCOPE_CATCH_UP_USAGE = [
+    "Usage: epic-implementer scope-catch-up --epic-run-id <id> --scope-id <scope> [--json]",
+    "",
+    "Replay merges the run's OWN index scope did not observe, through the same guarded",
+    "advance gate the merge webhook uses. There is no force: a blocked advance is",
+    "refused (SCOPE_CATCH_UP_REFUSED). The scope must be the one bound to the named",
+    "run, or the server refuses it (TICKET_NOT_IN_RUN) with nothing written. Prints",
+    "the scope lifecycle before → after; it does not wait for a scheduled parse.",
+].join("\n");
+export async function runScopeCatchUpCommand(argv) {
+    try {
+        const parsed = parseScopeCatchUpArgs(argv);
+        if (parsed.help) {
+            console.log(SCOPE_CATCH_UP_USAGE);
+            return 0;
+        }
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { scopeCatchUpRepair } = await import("./recovery-operations.js");
+        const outcome = await scopeCatchUpRepair(access, {
+            epicRunId: parsed.epicRunId,
+            scopeId: parsed.scopeId,
+        });
+        return renderRepairResult(outcome, {
+            verb: "scope-catch-up",
+            epicRunId: parsed.epicRunId,
+            targetLabel: `scope ${parsed.scopeId}`,
+            stateLabel: "scope lifecycle",
+        }, parsed.json, (result) => [
+            `  outcome:         ${result.outcome}${result.parse_scheduled ? " (parse scheduled)" : ""}`,
+        ]);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}
+const PATCH_POLICY_USAGE = [
+    "Usage: epic-implementer patch-policy --epic-run-id <id> --patch-file <path> [--json]",
+    "",
+    "Apply a JSON merge patch (RFC 7396) to the run's policy ON THE SERVER: it reads",
+    "the stored policy, merges your patch, validates the result, and writes it. You",
+    "never send or see the whole policy, so a value you cannot see is never dropped.",
+    "A null deletes a key. Protected paths (base_branch, notify.webhook_url, and",
+    "server-retained keys) are refused. For a whole replacement use",
+    "`setup-epic --replace-policy`.",
+    "",
+    "--patch-file must hold a non-empty JSON object of at most POLICY_PATCH_MAX_BYTES",
+    `(${POLICY_PATCH_MAX_BYTES} bytes). Its contents are never printed; the result names only`,
+    "the changed dotted paths and before/after policy digest tokens.",
+].join("\n");
+export async function runPatchPolicyCommand(argv, deps = {}) {
+    try {
+        const parsed = parsePatchPolicyArgs(argv);
+        if (parsed.help) {
+            console.log(PATCH_POLICY_USAGE);
+            return 0;
+        }
+        // Read and validate the patch BEFORE credentials are resolved or the HTTP
+        // graph is loaded, so an invalid file costs nothing and reaches no one.
+        let bytes;
+        try {
+            bytes = await (deps.readFile ?? ((p) => readFile(p)))(parsed.patchFile);
+        }
+        catch {
+            throw new ConductorValidationError("--patch-file could not be read; nothing was sent.");
+        }
+        const mergePatch = decodePolicyPatchFile(bytes);
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { patchPolicyRepair } = await import("./recovery-operations.js");
+        const outcome = await patchPolicyRepair(access, {
+            epicRunId: parsed.epicRunId,
+            mergePatch,
+        });
+        return renderRepairResult(outcome, {
+            verb: "patch-policy",
+            epicRunId: parsed.epicRunId,
+            targetLabel: "run policy",
+            stateLabel: "policy digest",
+        }, parsed.json, (result) => [
+            `  policy paths:    ${result.policy_paths.length > 0 ? result.policy_paths.join(", ") : "none"}`,
+        ]);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}
+const RESUME_RUN_USAGE = [
+    "Usage: epic-implementer resume-run --epic-run-id <id> [--clear-quarantine] [--json]",
+    "",
+    "Clear a paused run's control record and return it to active, after the server",
+    "re-checks the run's activation requirements. A quarantined run resumes only with",
+    "--clear-quarantine; a stopped run never resumes (start a new run). A run that is",
+    "already active with no control record is a successful no-op. The server retries",
+    "a concurrent control change itself — never supply a generation.",
+].join("\n");
+export async function runResumeRunCommand(argv) {
+    try {
+        const parsed = parseResumeRunArgs(argv);
+        if (parsed.help) {
+            console.log(RESUME_RUN_USAGE);
+            return 0;
+        }
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { resumeRunRepair } = await import("./recovery-operations.js");
+        const outcome = await resumeRunRepair(access, {
+            epicRunId: parsed.epicRunId,
+            clearQuarantine: parsed.clearQuarantine,
+        });
+        return renderRepairResult(outcome, {
+            verb: "resume-run",
+            epicRunId: parsed.epicRunId,
+            targetLabel: parsed.clearQuarantine ? "run control (clear quarantine)" : "run control",
+            stateLabel: "run control",
+        }, parsed.json);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}

package/build/conductor/recovery-operations.js

@@ -2,8 +2,9 @@
  * Shared Bridge API operator-recovery operations (BAPI-872).
  *
  * Centralizes stop, abandon, ticket unpark/adopt-current-head-and-unpark, and
- * (BAPI-1154) the three run-addressed repair verbs — scope-reparse,
- * dispatch-remediation, merge-child — so
+ * the six run-addressed repair verbs — (BAPI-1154) scope-reparse,
+ * dispatch-remediation, merge-child and (BAPI-1176) scope-catch-up,
+ * patch-policy, resume-run — so
  * the conductor CLI recovery verbs (`recovery-cli.ts`) and `plane down`
  * (`../plane/shutdown.ts`, wired through `../plane/cli.ts`) share EXACTLY the
  * same stop semantics, and so this module — never a caller — owns every
@@ -17,7 +18,7 @@
  * callers: `recovery-cli.ts` and `plane/shutdown.ts`.
  */
 import { randomUUID } from "crypto";
-import { adoptCurrentHeadAndUnparkTicket, completeMergeChild, ConductorBridgeApiError, dispatchRemediation, fetchEpicRunState, mergeChild, safeDiagnosticMessage, scopeReparse, stopEpicRun, unparkEpicTicket, updateEpicRunStatus, } from "./bridge-api-client.js";
+import { adoptCurrentHeadAndUnparkTicket, completeMergeChild, ConductorBridgeApiError, dispatchRemediation, fetchEpicRunState, mergeChild, patchPolicy, resumeRun, safeDiagnosticMessage, scopeCatchUp, scopeReparse, stopEpicRun, unparkEpicTicket, updateEpicRunStatus, } from "./bridge-api-client.js";
 import { DEFAULT_GATE_NAME } from "./git-ci-types.js";
 import { resolveLocalMergeMethod, runApprovedLocalMerge } from "./local-merge.js";
 /**
@@ -223,7 +224,11 @@ export async function adoptCurrentHeadAndUnparkWithRetry(access, options) {
 }
 /**
  * Classify a thrown client error. A 4xx carrying a server `error_code` is a
- * NAMED refusal and keeps that code; everything else (transport, timeout, 5xx
+ * NAMED refusal and keeps that code — whether it is one of the closed repair
+ * codes in `repair-contract.ts` or an established pass-through code the server's
+ * own posture, activation, or run-control checks emit (`RUN_CONTROL_MALFORMED`,
+ * for example). Both are rendered from server-owned error data; this layer never
+ * rewrites or re-infers a code. Everything else (transport, timeout, 5xx
  * without a code, an unparseable body) is `unavailable` with a bounded
  * diagnostic. No raw body, URL, header, or credential ever reaches either shape.
  */
@@ -340,3 +345,50 @@ export async function mergeChildRepair(access, options, deps = {}) {
         return classifyRepairError(err, "merge-child completion failed");
     }
 }
+// ---------------------------------------------------------------------------
+// BAPI-1176 — scope-catch-up, patch-policy, resume-run
+// ---------------------------------------------------------------------------
+// Thin like scope-reparse: one mutation call, the server's result returned
+// verbatim, every failure through the shared classifier.
+/**
+ * Catch the run's own index scope up with merges it did not observe. The server
+ * decides ownership, and a blocked advance is a refusal — never a forced repair.
+ */
+export async function scopeCatchUpRepair(access, options, deps = {}) {
+    try {
+        const call = deps.scopeCatchUp ?? scopeCatchUp;
+        return { ok: true, result: await call(access, options) };
+    }
+    catch (err) {
+        return classifyRepairError(err, "scope-catch-up request failed");
+    }
+}
+/**
+ * Apply a merge patch to the run's policy. `mergePatch` must already be a
+ * validated non-empty object within `POLICY_PATCH_MAX_BYTES`; the server does the
+ * read, merge, validation, and guarded write, and reports only path names and
+ * digest tokens.
+ */
+export async function patchPolicyRepair(access, options, deps = {}) {
+    try {
+        const call = deps.patchPolicy ?? patchPolicy;
+        return { ok: true, result: await call(access, options) };
+    }
+    catch (err) {
+        return classifyRepairError(err, "patch-policy request failed");
+    }
+}
+/**
+ * Resume a paused run, or a quarantined one with `clearQuarantine`. The server
+ * re-evaluates activation and owns the control-generation CAS retry; nothing here
+ * reads or sends a generation.
+ */
+export async function resumeRunRepair(access, options, deps = {}) {
+    try {
+        const call = deps.resumeRun ?? resumeRun;
+        return { ok: true, result: await call(access, options) };
+    }
+    catch (err) {
+        return classifyRepairError(err, "resume-run request failed");
+    }
+}