@bridge_gpt/mcp-server 0.2.57 → 0.2.59

package/build/doctor.js

@@ -22,6 +22,8 @@ import { createDefaultStartTicketsDeps } from "./start-tickets.js";
 import { VERSION, BUILD_COMMIT } from "./version.generated.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, formatInstallStatusFallbackReport, resolveInstallDoctorTarget, } from "./install-doctor.js";
 import { codexHome, inspectBridgeCodexProfile } from "./codex-bridge-profile.js";
+import { resolveRoutingHost } from "./model-routing-host.js";
+import { modelRoutingPreferencesPath, readModelRoutingPreference } from "./model-routing-preferences.js";
 import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "./agent-launchers/executor-adapter-inspection.js";
 import { resolveExecutorAgentAdapter } from "./agent-launchers/executor-adapter-registry.js";
 import { parseDefaultOnEnvFlag } from "./env-flags.js";
@@ -29,15 +31,13 @@ import { createBridgeApiUrls } from "./bridge-api-urls.js";
 import { probeToolSurface } from "./tool-surface-gating.js";
 import { resolveBapiCredentials } from "./credential-store.js";
 import { resolveConductorBridgeApiAccess } from "./conductor/bridge-api-client.js";
-import { getLiveRepositoryConductors, getParseDispatcherHealth, } from "./implement-epic/bridge-client.js";
-import { resolveConductEpicStateDirectory } from "./implement-epic/checkpoint-store.js";
-import { isConductEpicLockOwnerAlive, parseConductEpicLock, } from "./implement-epic/lock.js";
+import { getLiveRepositoryConductors, getParseDispatcherHealth, } from "./epic-shared/bridge-client.js";
 import { resolveRequiredStartTicketsRepoName } from "./start-tickets-repo.js";
 import { collectWorkerContainmentDiagnostic, formatWorkerContainmentDiagnosticReport, } from "./worker-containment-diagnostic.js";
 import { BRIDGE_PACKAGE_NAME, describeLauncherReason, DUPLICATE_REGISTRATION_GUIDANCE, inspectLauncherConfigs, parseLauncherPin as parseSharedLauncherPin, } from "./launcher-config-inspection.js";
 import { MCP_SERVER_NAME, MCP_PACKAGE_NAME, } from "./mcp-identity.js";
 import { DEFAULT_AGENT_NAME, resolveAgentSpec, isAgentName, formatValidAgentNames, } from "./agent-registry.js";
-import { getDoctorPrereqDescriptors, probePrerequisite, resolveWorktrunkBinary, } from "./start-tickets-prereqs.js";
+import { getDoctorPrereqDescriptors, probePrerequisite, } from "./start-tickets-prereqs.js";
 import { resolveProfiles } from "./mcp-profile.js";
 import { executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, inspectExecutorServiceArtifact, EXECUTOR_SERVICE_BASE_URL_ENV, } from "./executor/index.js";
 import { DEFAULT_BAPI_BASE_URL } from "./executor/credentials.js";
@@ -1311,175 +1311,6 @@ export function formatPlaneCredentialDiagnosticReport(diagnostic) {
     lines.push("           no .bridge/plane/ directory, persists nothing, and starts no plane member.");
     return lines.join("\n");
 }
-/**
- * Collect implement-epic readiness, read-only.
- *
- * The credential is resolved only to establish that it CAN be, and the resolved
- * access object is discarded immediately: only the repo name and a boolean
- * survive into the returned diagnostic, so no later formatting change can print
- * a key it never received.
- */
-export async function collectConductEpicDiagnostic(deps) {
-    const isAlive = deps.isProcessAlive ?? isConductEpicLockOwnerAlive;
-    let ghPresent = false;
-    let ghAuthenticated = false;
-    try {
-        const version = await deps.runCommand("gh", ["--version"], { cwd: deps.cwd });
-        ghPresent = version.exitCode === 0;
-    }
-    catch {
-        ghPresent = false;
-    }
-    if (ghPresent) {
-        try {
-            const auth = await deps.runCommand("gh", ["auth", "status"], { cwd: deps.cwd });
-            ghAuthenticated = auth.exitCode === 0;
-        }
-        catch {
-            ghAuthenticated = false;
-        }
-    }
-    const worktrunkBinary = resolveWorktrunkBinary(deps.platform, deps.env);
-    let worktrunkAvailable = false;
-    try {
-        const probe = await deps.runCommand(worktrunkBinary, ["--version"], { cwd: deps.cwd });
-        worktrunkAvailable = probe.exitCode === 0;
-    }
-    catch {
-        worktrunkAvailable = false;
-    }
-    const resolveAccess = deps.resolveAccess ?? resolveConductorBridgeApiAccess;
-    let repo = null;
-    let bridgeCredentialResolved = false;
-    try {
-        const result = await resolveAccess({
-            env: deps.env,
-            cwd: deps.cwd,
-            homedir: deps.homedir,
-            platform: deps.platform,
-            readFile: deps.readFile,
-            stat: deps.stat,
-        });
-        if (result.ok) {
-            repo = result.access.repoName;
-            bridgeCredentialResolved = true;
-        }
-    }
-    catch {
-        bridgeCredentialResolved = false;
-    }
-    let stateDirectory = null;
-    let stateDirectoryReadable = false;
-    const checkpoints = [];
-    const locks = [];
-    if (repo !== null) {
-        stateDirectory = resolveConductEpicStateDirectory(repo, {
-            env: deps.env,
-            homedir: deps.homedir,
-        });
-        let entries = [];
-        try {
-            entries = await deps.readdir(stateDirectory);
-            stateDirectoryReadable = true;
-        }
-        catch {
-            stateDirectoryReadable = false;
-        }
-        for (const entry of entries) {
-            if (entry.endsWith(".json"))
-                checkpoints.push(entry);
-            if (!entry.endsWith(".lock"))
-                continue;
-            const epic = entry.slice(0, -".lock".length);
-            let raw;
-            try {
-                raw = await deps.readFile(path.join(stateDirectory, entry));
-            }
-            catch {
-                locks.push({ epic, owner_pid: null, host: null, alive: null, problem: "unreadable" });
-                continue;
-            }
-            const owner = parseConductEpicLock(raw);
-            if (owner === null) {
-                locks.push({ epic, owner_pid: null, host: null, alive: null, problem: "malformed or unsupported version" });
-                continue;
-            }
-            // Liveness is only meaningful for a lock taken on THIS host.
-            const alive = owner.host === deps.env.HOSTNAME || owner.host === os.hostname()
-                ? isAlive(owner.owner_pid)
-                : null;
-            locks.push({ epic, owner_pid: owner.owner_pid, host: owner.host, alive });
-        }
-    }
-    return {
-        ghPresent,
-        ghAuthenticated,
-        worktrunkBinary,
-        worktrunkAvailable,
-        repo,
-        bridgeCredentialResolved,
-        stateDirectory,
-        stateDirectoryReadable,
-        checkpoints,
-        locks,
-    };
-}
-/** Render the implement-epic section. Advisory: never changes the exit code. */
-export function formatConductEpicDiagnosticReport(diagnostic) {
-    const lines = ["", "implement-epic readiness (advisory)"];
-    lines.push(diagnostic.ghAuthenticated
-        ? "  OK       gh: present and authenticated."
-        : diagnostic.ghPresent
-            ? "  MISSING  gh: present but NOT authenticated. Run `gh auth login`."
-            : "  MISSING  gh: not found on PATH. `implement-epic init` and `status` need it.");
-    lines.push(diagnostic.worktrunkAvailable
-        ? `  OK       Worktrunk: '${diagnostic.worktrunkBinary}' resolves.`
-        : `  MISSING  Worktrunk: '${diagnostic.worktrunkBinary}' not found (honors BAPI_WORKTRUNK_BIN).`);
-    if (diagnostic.repo === null) {
-        lines.push("  MISSING  Bridge identity: the repository could not be resolved. Set BAPI_REPO_NAME\n" +
-            "           or add a valid .bridge/config at the repository root.");
-    }
-    else if (diagnostic.bridgeCredentialResolved) {
-        lines.push(`  OK       Bridge credential for ${diagnostic.repo}: resolved.`);
-    }
-    else {
-        lines.push(`  MISSING  Bridge credential for ${diagnostic.repo}: NOT resolved.`);
-    }
-    if (diagnostic.stateDirectory === null) {
-        lines.push("  SKIP     Checkpoint directory: not resolved (no repository identity).");
-    }
-    else if (!diagnostic.stateDirectoryReadable) {
-        lines.push(`  SKIP     Checkpoint directory ${diagnostic.stateDirectory}: absent or unreadable\n` +
-            "           (normal before the first `implement-epic init`).");
-    }
-    else {
-        lines.push(`  OK       Checkpoint directory ${diagnostic.stateDirectory}: readable, ` +
-            `${diagnostic.checkpoints.length} checkpoint(s).`);
-    }
-    if (diagnostic.locks.length === 0) {
-        lines.push("  OK       Locks: none held.");
-    }
-    else {
-        for (const lock of diagnostic.locks) {
-            if (lock.problem !== undefined) {
-                lines.push(`  WARN     Lock ${lock.epic}: ${lock.problem}. Inspect it by hand.`);
-            }
-            else if (lock.alive === false) {
-                lines.push(`  WARN     Lock ${lock.epic}: owner pid ${lock.owner_pid} on ${lock.host} is gone (stale).\n` +
-                    "           The next mutating verb recovers it automatically.");
-            }
-            else if (lock.alive === null) {
-                lines.push(`  WARN     Lock ${lock.epic}: taken on host ${lock.host}; liveness is unknowable here.`);
-            }
-            else {
-                lines.push(`  OK       Lock ${lock.epic}: held by live pid ${lock.owner_pid}.`);
-            }
-        }
-    }
-    lines.push("           Read-only: this section probes commands and reads local state. It recovers no");
-    lines.push("           lock, rewrites no checkpoint, and never changes the exit code.");
-    return lines.join("\n");
-}
 /**
  * The transitional local helpers BAPI-1102 retires.
  *
@@ -1501,14 +1332,10 @@ export const LEGACY_DRIVE_HELPER_RELATIVE_PATHS = [
 /**
  * Collect the operational advisories, read-only.
  *
- * Local pilot conductors are identified from the SAME checkpoint-directory and
- * lock inspection `implement-epic readiness` uses — `parseConductEpicLock` plus the
- * injected liveness seam — never from the process table. Only a lock proven live
- * on THIS host counts; malformed, unreadable, dead, and remote-host locks are
- * excluded from the live set, with the indeterminate ones counted separately.
+ * Concurrent conductors and parse-dispatcher health are read from two read-only
+ * Bridge GETs; no local process table or lock directory is inspected.
  */
 export async function collectOperationalAdvisories(deps) {
-    const isAlive = deps.isProcessAlive ?? isConductEpicLockOwnerAlive;
     const now = deps.now ?? (() => new Date());
     const resolveAccess = deps.resolveAccess ?? resolveConductorBridgeApiAccess;
     let dispatcher = null;
@@ -1542,63 +1369,6 @@ export async function collectOperationalAdvisories(deps) {
             conductors.push(...live.value.conductors);
         }
     }
-    // Local pilot locks. Read through the same path the readiness section uses; a
-    // failure to read the directory is silence, not a claim that none are held.
-    let indeterminateLocks = 0;
-    if (repo !== null) {
-        const stateDirectory = resolveConductEpicStateDirectory(repo, {
-            env: deps.env,
-            homedir: deps.homedir,
-        });
-        let entries = [];
-        try {
-            entries = await deps.readdir(stateDirectory);
-        }
-        catch {
-            entries = [];
-        }
-        for (const entry of entries) {
-            if (!entry.endsWith(".lock"))
-                continue;
-            const epic = entry.slice(0, -".lock".length);
-            let raw;
-            try {
-                raw = await deps.readFile(path.join(stateDirectory, entry));
-            }
-            catch {
-                indeterminateLocks += 1;
-                continue;
-            }
-            const owner = parseConductEpicLock(raw);
-            if (owner === null) {
-                indeterminateLocks += 1;
-                continue;
-            }
-            const local = owner.host === deps.env.HOSTNAME || owner.host === os.hostname();
-            if (!local) {
-                indeterminateLocks += 1;
-                continue;
-            }
-            if (!isAlive(owner.owner_pid))
-                continue;
-            // A pilot lock and a v2 run are two DISTINCT conductor authorities. Even
-            // when both name the same epic they are not deduplicated — that pairing is
-            // precisely the overlap an operator most needs to see.
-            //
-            // The key comes from a FILENAME, so it is bounded against the epic-key shape
-            // before it is rendered; an unrecognized name reports `unknown` rather than
-            // putting arbitrary filesystem text into a diagnostic line.
-            conductors.push({
-                kind: "pilot",
-                epicKey: validateTicketKey(epic, "epic key").ok ? epic : null,
-                state: "lock held",
-                livenessSource: "lock",
-            });
-        }
-        if (conductors.length > 0 && conductorObservation !== "observed") {
-            conductorObservation = "observed";
-        }
-    }
     // BAPI-1102 — a pure path-presence check, using the SAME injected `stat` and
     // `homedir` seams every other advisory here uses, so it stays deterministic
     // under test and reaches no real filesystem in one. A `stat` that throws is
@@ -1620,7 +1390,6 @@ export async function collectOperationalAdvisories(deps) {
         dispatcher,
         conductorObservation,
         conductors,
-        indeterminateLocks,
         legacyDriveHelpers,
     };
 }
@@ -1658,10 +1427,6 @@ export function formatOperationalAdvisoryReport(diagnostic) {
         lines.push("           A distinct-epic overlap is informational and may be legitimate: separately\n" +
             "           scoped epics do not share transition authority.");
     }
-    if (diagnostic.indeterminateLocks > 0) {
-        lines.push(`           ${diagnostic.indeterminateLocks} local lock(s) could not be judged (remote host,\n` +
-            "           malformed, or unreadable) and are excluded from the live count.");
-    }
     // BAPI-1102. A WARN, never a failure, and deliberately separate from every
     // readiness signal above: a stale helper says nothing about whether this
     // repository's conductor works, so classifying it as a readiness problem would
@@ -1677,7 +1442,7 @@ export function formatOperationalAdvisoryReport(diagnostic) {
             "           doctor performed a PATH-PRESENCE check only: it did not run, read, or\n" +
             "           modify either file, and it cannot delete them for you.");
     }
-    lines.push("           Read-only: this section issues two Bridge GETs and reads local lock state. It");
+    lines.push("           Read-only: this section issues two Bridge GETs and reads no local state. It");
     lines.push("           runs NO command probe, repairs no scheduler, and never changes the exit code.");
     return lines.join("\n");
 }
@@ -1748,8 +1513,17 @@ export async function runDoctorCli(argv, overrides = {}) {
         const profile = await inspectBridgeCodexProfile(codexHome(deps.env), readCodexFile);
         log(profile.status === "active"
             ? "Codex Bridge approval profile installed; spawned workers use --profile bridge."
-            : `Codex Bridge approval profile ${profile.status}; spawned workers use existing Codex approvals. Run install --tools=codex --codex-profile=on to opt in.`);
-    }
+            : profile.status === "stale"
+                ? "Codex Bridge approval profile is an older unmodified managed version; the next spawned worker refreshes it before launch."
+                : `Codex Bridge approval profile ${profile.status}; spawned workers use existing Codex approvals. Run install --tools=codex --codex-profile=on to opt in.`);
+    }
+    // Read-only personal routing diagnostics. The installer marker is a hint;
+    // an initialized MCP client identity takes precedence during real requests.
+    const routingHost = resolveRoutingHost(undefined, deps.env.BAPI_MCP_HOST_FAMILY);
+    log(`Model routing host marker: ${routingHost.warning ?? routingHost.family ?? "neutral"}.`);
+    const preferencePath = modelRoutingPreferencesPath(deps.homedir?.() ?? os.homedir());
+    const preference = await readModelRoutingPreference(deps.env.BAPI_REPO_NAME ?? "_doctor_unscoped_", "review_ticket", preferencePath);
+    log(`Personal model routing preference: ${preference.warning ?? preference.source}.`);
     log(formatDoctorPrereqSection(deps.platform, collection));
     // Executor-adapter section (BAPI-781). Advisory with respect to the EXIT CODE
     // — an unusable adapter is reported loudly but does not change doctor's
@@ -1971,55 +1745,8 @@ export async function runDoctorCli(argv, overrides = {}) {
             }));
         }
     }
-    // Advisory implement-epic section (BAPI-803). Read-only, and — like every
-    // section above — it cannot change the exit code: `implement-epic init` enforces
-    // these same invariants at the point where they actually block, and someone who
-    // never conducts an epic should not see a failing doctor because of it.
-    //
-    // Skipped entirely on an unsupported platform. This section is the only
-    // advisory one that runs COMMAND probes (`gh`, Worktrunk), and doctor's
-    // standing contract is that an unsupported platform probes nothing at all —
-    // reporting on tooling for a `implement-epic` that cannot run there would buy
-    // nothing and break that contract.
-    if (overrides.conductEpic !== false && collection.ok) {
-        try {
-            const injectedFs = deps;
-            const conductDeps = {
-                env: overrides.conductEpic?.env ?? deps.env,
-                cwd: overrides.conductEpic?.cwd ?? deps.cwd,
-                platform: overrides.conductEpic?.platform ?? deps.platform,
-                homedir: overrides.conductEpic?.homedir ?? injectedFs.homedir ?? os.homedir,
-                readFile: overrides.conductEpic?.readFile ??
-                    injectedFs.readFile ??
-                    ((p) => readFile(p, "utf-8")),
-                stat: overrides.conductEpic?.stat ?? injectedFs.stat ?? ((p) => stat(p)),
-                readdir: overrides.conductEpic?.readdir ?? ((p) => readdir(p)),
-                runCommand: overrides.conductEpic?.runCommand ?? deps.runCommand,
-                resolveAccess: overrides.conductEpic?.resolveAccess,
-                isProcessAlive: overrides.conductEpic?.isProcessAlive,
-            };
-            log(formatConductEpicDiagnosticReport(await collectConductEpicDiagnostic(conductDeps)));
-        }
-        catch {
-            // Any unexpected failure still renders a sanitized advisory section rather
-            // than dropping it or leaking exception text.
-            log(formatConductEpicDiagnosticReport({
-                ghPresent: false,
-                ghAuthenticated: false,
-                worktrunkBinary: resolveWorktrunkBinary(deps.platform, deps.env),
-                worktrunkAvailable: false,
-                repo: null,
-                bridgeCredentialResolved: false,
-                stateDirectory: null,
-                stateDirectoryReadable: false,
-                checkpoints: [],
-                locks: [],
-            }));
-        }
-    }
-    // Advisory operational-advisories section (BAPI-963), placed immediately after
-    // `implement-epic readiness` because both are read by the same operator at the
-    // same moment — "can I conduct?" then "what else is already running?".
+    // Advisory operational-advisories section (BAPI-963). Read by the operator
+    // asking "what is already running?" right after the readiness sections above.
     //
     // Gated on `collection.ok` for the same reason the section above is: an
     // unsupported platform reports nothing. That gate is belt-and-braces here,
@@ -2042,9 +1769,7 @@ export async function runDoctorCli(argv, overrides = {}) {
                     injectedFs.readFile ??
                     ((p) => readFile(p, "utf-8")),
                 stat: overrides.operationalAdvisories?.stat ?? injectedFs.stat ?? ((p) => stat(p)),
-                readdir: overrides.operationalAdvisories?.readdir ?? ((p) => readdir(p)),
                 resolveAccess: overrides.operationalAdvisories?.resolveAccess,
-                isProcessAlive: overrides.operationalAdvisories?.isProcessAlive,
                 fetchImpl: overrides.operationalAdvisories?.fetchImpl,
                 now: overrides.operationalAdvisories?.now,
             };
@@ -2057,7 +1782,6 @@ export async function runDoctorCli(argv, overrides = {}) {
                 dispatcher: null,
                 conductorObservation: "unavailable",
                 conductors: [],
-                indeterminateLocks: 0,
                 // Empty, not omitted: a collection that failed has not established
                 // that a legacy helper is absent, and a fallback that CLAIMED to have
                 // checked would be the one kind of wrong answer worse than silence.

package/build/drive-epic.js

@@ -1,32 +1,29 @@
 /**
  * `drive-epic` — the one universal conductor entry point (BAPI-887).
  *
- * Bridge has two conductors and a standing rule that they must never operate on
- * the same epic: two transition authorities on one epic wedge it permanently.
- *
- *   - **v2 engine** — bootstrapped by `setup-epic`, which creates a durable
- *     `epic_run` row, stores a plan DAG, and approves it.
- *   - **LLM-conductor pilot** — `/loop 5m /conduct-epic <EPIC>`, which creates no
- *     run row and keeps its whole memory in a local checkpoint plus GitHub.
+ * Bridge has one conductor — the **v2 engine**, bootstrapped by `setup-epic`,
+ * which creates a durable `epic_run` row, stores a plan DAG, and approves it. The
+ * standing rule is that exactly one transition authority ever operates on an
+ * epic: two authorities on one epic wedge it permanently.
  *
  * Asking a prompt to pick correctly every time is not a control. This subcommand
  * makes the choice STRUCTURAL: it reads server-side conductor readiness and
- * routes to exactly one path, so no prompt names either underlying conductor and
- * no prompt can present both. Every ticket-authoring surface hands off to
- * `drive-epic` and to nothing else.
+ * routes to exactly one path, so no prompt names the underlying conductor. Every
+ * ticket-authoring surface hands off to `drive-epic` and to nothing else.
  *
  * ## The output invariant
  *
  * Every branch — including every error path — emits **at most one** conductor
- * invocation. An escalation carries NO alternative conductor command: "v2 failed,
- * try the pilot instead" is precisely the dual-authority hazard this subcommand
- * exists to remove. {@link assertSingleConductorInvocation} enforces this on the
- * way out rather than trusting each branch to have got it right.
+ * invocation. A not-ready result or an escalation carries NO alternative
+ * conductor command: "v2 failed, try something else instead" is precisely the
+ * dual-authority hazard this subcommand exists to remove.
+ * {@link assertSingleConductorInvocation} enforces this on the way out rather than
+ * trusting each branch to have got it right.
  *
  * ## Three-state routing, fail-closed
  *
  *   - readiness green            -> delegate to the `setup-epic` (v2) flow
- *   - readiness read, not green  -> print the pilot instruction
+ *   - readiness read, not green  -> report v2 not-ready, offer no alternative
  *   - readiness UNKNOWN          -> escalate to the operator, print no conductor
  *
  * Unknown is never treated as not-ready, and selection never happens by
@@ -72,17 +69,16 @@ import { validateBranchName } from "./base-ref.js";
 // BAPI-806: mcp-identity.ts is the SOLE source of the package-name literal, so
 // the printed invocation interpolates it rather than repeating it.
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
-/** Jira epic key shape. Matches `implement-epic`'s positional rule exactly. */
+/** Jira epic key shape. Matches the epic-key positional rule exactly. */
 const EPIC_KEY_PATTERN = /^[A-Z]+-[0-9]+$/;
-/** The two conductor paths. Derived types below come from this constant. */
-export const DRIVE_EPIC_CONDUCTORS = ["v2", "pilot"];
+/** The conductor paths. Derived types below come from this constant. */
+export const DRIVE_EPIC_CONDUCTORS = ["v2"];
 /**
- * THE consolidation-day edit point.
+ * The preferred conductor.
  *
- * When readiness is green, v2 is preferred and the pilot is the fallback for
- * projects that cannot run it. This is expressed as one named constant rather
- * than as branching scattered through the routing logic precisely so that
- * eliminating a conductor is a one-line change plus one deleted branch.
+ * v2 is the only conductor: when readiness is green it drives the epic, and when
+ * it is not the command reports v2 not-ready with no alternative. Expressed as
+ * one named constant rather than branching scattered through the routing logic.
  */
 export const DRIVE_EPIC_PREFERRED_CONDUCTOR = "v2";
 /**
@@ -482,10 +478,10 @@ export function parseDriveEpicArgs(argv) {
  * v2 engine drive an epic at all?", and the answer does not depend on whether
  * the repository has consented to UNATTENDED operation: an attended v2 run on a
  * non-consenting repository is a perfectly ordinary, fully supported run.
- * Including them would route every such repository to the pilot conductor the
- * moment this ticket deployed — a silent, repository-wide change of conductor for
- * a reason that has nothing to do with the choice, and the exact opposite of
- * AC-3's "nothing changes for an existing run".
+ * Including them would report v2 not-ready for every such repository the moment
+ * this ticket deployed — a silent, repository-wide refusal for a reason that has
+ * nothing to do with readiness, and the exact opposite of AC-3's "nothing
+ * changes for an existing run".
  *
  * They still gate the COMPOSED bring-up, through
  * {@link classifyV2Readiness}, which is where an unattended run is actually
@@ -501,8 +497,7 @@ export function selectConductor(readiness) {
         };
     }
     return {
-        kind: "selected",
-        conductor: "pilot",
+        kind: "not_ready",
         reason: `the engine path still needs ${missing.map((m) => m.describe).join("; ")}`,
     };
 }
@@ -536,51 +531,35 @@ export function buildSetupEpicArgv(options) {
     ];
 }
 /**
- * Render the selected path and only the selected path.
- *
- * Precondition: the caller has already ruled out delegation. The `v2` branch
- * reads as "green, but no plan file was supplied", which is only true once
- * {@link runDriveEpicCli} has declined to delegate — so route first, render
- * second.
+ * Render the selected v2 path and only that path.
  *
- * CONSOLIDATION DAY: delete the branch of the conductor being eliminated and
- * point {@link DRIVE_EPIC_PREFERRED_CONDUCTOR} at the survivor. Nothing outside
- * this file moves.
+ * Precondition: the caller has already ruled out delegation and a not-ready
+ * result. The `v2` branch reads as "green, but no plan file was supplied", which
+ * is only true once {@link runDriveEpicCli} has declined to delegate — so route
+ * first, render second.
  */
 export function renderConductorHandoff(selection, epicKey) {
-    if (selection.conductor === "v2") {
-        const invocation = `npx -y ${MCP_PACKAGE_NAME} drive-epic ${epicKey} --plan-file <path>`;
-        return {
-            conductor: "v2",
-            invocation,
-            lines: [
-                `${epicKey}: ${selection.reason}, but no plan file was supplied.`,
-                "",
-                "The engine path needs a plan DAG, and nothing derives one from an epic key:",
-                "the dependency edges and per-ticket touched_files it carries do not exist",
-                "anywhere else. Produce one, then re-run this command with it.",
-                "",
-                `  1. Run /plan-epic ${epicKey} in an interactive session. It writes the`,
-                "     sidecar to {docs_dir}/epic-plans/{epic_slug}/epic-plan.dag.json.",
-                "     If the epic's tickets already exist, run emit-epic-implementer-bundle",
-                "     finalize instead — it resolves the placeholder keys in an existing",
-                "     sidecar and attaches touched_files.",
-                "",
-                `  2. ${invocation}`,
-                "",
-                `That second command bootstraps the run for you; ${SETUP_EPIC_SUBCOMMAND} is not`,
-                "something you invoke directly.",
-            ],
-        };
-    }
-    const invocation = `/loop 5m /conduct-epic ${epicKey}`;
+    const invocation = `npx -y ${MCP_PACKAGE_NAME} drive-epic ${epicKey} --plan-file <path>`;
     return {
-        conductor: "pilot",
+        conductor: "v2",
         invocation,
         lines: [
-            `${epicKey}: ${selection.reason}. Drive it from an interactive session with:`,
+            `${epicKey}: ${selection.reason}, but no plan file was supplied.`,
+            "",
+            "The engine path needs a plan DAG, and nothing derives one from an epic key:",
+            "the dependency edges and per-ticket touched_files it carries do not exist",
+            "anywhere else. Produce one, then re-run this command with it.",
+            "",
+            `  1. Run /plan-epic ${epicKey} in an interactive session. It writes the`,
+            "     sidecar to {docs_dir}/epic-plans/{epic_slug}/epic-plan.dag.json.",
+            "     If the epic's tickets already exist, run emit-epic-implementer-bundle",
+            "     finalize instead — it resolves the placeholder keys in an existing",
+            "     sidecar and attaches touched_files.",
             "",
-            `  ${invocation}`,
+            `  2. ${invocation}`,
+            "",
+            `That second command bootstraps the run for you; ${SETUP_EPIC_SUBCOMMAND} is not`,
+            "something you invoke directly.",
         ],
     };
 }
@@ -589,7 +568,7 @@ export function renderConductorHandoff(selection, epicKey) {
  * output guard and by its test — one list, so a new spelling cannot be added to
  * the renderer without the guard seeing it.
  */
-export const CONDUCTOR_INVOCATION_TOKENS = ["setup-epic", "conduct-epic"];
+export const CONDUCTOR_INVOCATION_TOKENS = ["setup-epic"];
 /** The v2 token, named once so prose and the guard cannot drift apart. */
 const SETUP_EPIC_SUBCOMMAND = CONDUCTOR_INVOCATION_TOKENS[0];
 /**
@@ -935,9 +914,9 @@ export async function runDriveEpicCli(argv, overrides = {}) {
         //
         // BAPI-1054: a supplied plan file is what makes this a BRING-UP decision
         // rather than a routing one. Everything below runs before `selectConductor`'s
-        // pilot fallback can be rendered, because a report that is non-green only on
-        // the runtime facts is not a "use the other conductor" situation — it is a
-        // plane that has not been started yet.
+        // not-ready result can be rendered, because a report that is non-green only on
+        // the runtime facts is not a "v2 cannot run" situation — it is a plane that
+        // has not been started yet.
         if (planFile) {
             // BAPI-1102 — the explicit `--attended` opt-out makes the unattended
             // prerequisites inapplicable. Both inputs are FLAG checks, not policy
@@ -1061,6 +1040,21 @@ export async function runDriveEpicCli(argv, overrides = {}) {
                 awaitPlaneReady: controlPlane.awaitPlaneReady,
             });
         }
+        // No plan file, and readiness is not green: v2 is not ready and there is no
+        // second conductor to offer. Report it as a not-ready refusal on stderr with
+        // exactly one — actually zero — conductor invocation, and a non-zero exit.
+        if (selection.kind === "not_ready") {
+            const refusal = [
+                `${epicKey}: ${selection.reason}.`,
+                "",
+                "The v2 engine is not ready to drive this epic, and there is no alternative",
+                "conductor to fall back to. Resolve conductor readiness (`install-bridge",
+                "conductor`, then `doctor`) and run drive-epic again.",
+            ].join("\n");
+            assertSingleConductorInvocation(refusal);
+            deps.errorLog(refusal);
+            return 1;
+        }
         const handoff = renderConductorHandoff(selection, epicKey);
         const text = handoff.lines.join("\n");
         assertSingleConductorInvocation(text);