@bridge_gpt/mcp-server 0.2.58 → 0.2.59

package/build/conductor/bridge-api-client.js

@@ -1331,6 +1331,155 @@ export async function completeMergeChild(access, request, fetchImpl = globalThis
     }, fetchImpl);
     return parseMergeChildRouteResponse(parsed);
 }
+// ---------------------------------------------------------------------------
+// BAPI-1176 — scope-catch-up, patch-policy, resume-run (CLI-only; no MCP tool)
+// ---------------------------------------------------------------------------
+// The same request path as the BAPI-1154 clients above, with STRICT parsers: a
+// response carrying any field outside its documented set is refused, so a server
+// that ever returned a generation, a control record, or a policy value would fail
+// closed here rather than reach operator output. No parser error echoes the body.
+/** The fields every repair response carries. */
+const REPAIR_BASE_KEYS = [
+    "epic_run_id",
+    "before",
+    "after",
+    "committed",
+    "event_recorded",
+];
+/** A bounded, closed-vocabulary token (a catch-up outcome such as `parse_scheduled`). */
+const REPAIR_TOKEN_RE = /^[a-z0-9_.:-]{1,120}$/;
+/** A `patch-policy` digest display token: `policy:` and twelve lowercase hex digits. */
+const POLICY_DIGEST_TOKEN_RE = /^policy:[0-9a-f]{12}$/;
+/** A dotted policy-path NAME. Never a value. */
+const POLICY_PATH_RE = /^[A-Za-z0-9_-]{1,100}(?:\.[A-Za-z0-9_-]{1,100}){0,15}$/;
+/** `resume-run`'s closed run-control state vocabulary. */
+const RESUME_RUN_STATES = ["paused", "quarantined", "none"];
+function requireOnlyRepairKeys(p, extraKeys) {
+    for (const key of Object.keys(p)) {
+        if (!REPAIR_BASE_KEYS.includes(key) && !extraKeys.includes(key)) {
+            throw new ConductorBridgeApiError("server");
+        }
+    }
+}
+function parseStrictNullableString(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== "string") {
+        throw new ConductorBridgeApiError("server");
+    }
+    return value;
+}
+function parseScopeCatchUpResult(parsed) {
+    const p = parseRepairBase(parsed);
+    requireOnlyRepairKeys(p, ["scope_id", "outcome", "parse_scheduled"]);
+    const scopeId = p["scope_id"];
+    const outcome = p["outcome"];
+    const parseScheduled = p["parse_scheduled"];
+    if (typeof scopeId !== "string" ||
+        typeof outcome !== "string" ||
+        !REPAIR_TOKEN_RE.test(outcome) ||
+        typeof parseScheduled !== "boolean") {
+        throw new ConductorBridgeApiError("server");
+    }
+    return {
+        epic_run_id: p["epic_run_id"],
+        scope_id: scopeId,
+        before: parseStrictNullableString(p["before"]),
+        after: parseStrictNullableString(p["after"]),
+        committed: p["committed"],
+        event_recorded: p["event_recorded"],
+        outcome,
+        parse_scheduled: parseScheduled,
+    };
+}
+function parsePatchPolicyResult(parsed) {
+    const p = parseRepairBase(parsed);
+    requireOnlyRepairKeys(p, ["policy_paths"]);
+    const before = p["before"];
+    const after = p["after"];
+    const paths = p["policy_paths"];
+    if (typeof before !== "string" ||
+        !POLICY_DIGEST_TOKEN_RE.test(before) ||
+        typeof after !== "string" ||
+        !POLICY_DIGEST_TOKEN_RE.test(after) ||
+        !Array.isArray(paths) ||
+        !paths.every((path) => typeof path === "string" && POLICY_PATH_RE.test(path))) {
+        throw new ConductorBridgeApiError("server");
+    }
+    return {
+        epic_run_id: p["epic_run_id"],
+        before,
+        after,
+        committed: p["committed"],
+        event_recorded: p["event_recorded"],
+        policy_paths: [...paths],
+    };
+}
+function parseResumeRunResult(parsed) {
+    const p = parseRepairBase(parsed);
+    requireOnlyRepairKeys(p, []);
+    const before = p["before"];
+    const after = p["after"];
+    if (typeof before !== "string" ||
+        !RESUME_RUN_STATES.includes(before) ||
+        typeof after !== "string" ||
+        !RESUME_RUN_STATES.includes(after)) {
+        throw new ConductorBridgeApiError("server");
+    }
+    return {
+        epic_run_id: p["epic_run_id"],
+        before,
+        after,
+        committed: p["committed"],
+        event_recorded: p["event_recorded"],
+    };
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/scope-catch-up` — replay merges the
+ * run's OWN index scope did not observe, through the unchanged guarded advance
+ * gate. Body EXACTLY `{repo_name, scope_id}`: no force flag and no caller-supplied
+ * commit. The server refuses a scope not bound to the run (`404
+ * TICKET_NOT_IN_RUN`) and a blocked advance (`409 SCOPE_CATCH_UP_REFUSED`).
+ */
+export async function scopeCatchUp(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    requireNonEmptyString(request.scopeId);
+    const parsed = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/scope-catch-up`, { scope_id: request.scopeId }, fetchImpl);
+    return parseScopeCatchUpResult(parsed);
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/patch-policy` — body EXACTLY
+ * `{repo_name, merge_patch}`. The SERVER reads the stored policy, applies the RFC
+ * 7396 merge patch, validates the result, and writes it under a snapshot guard.
+ * This is deliberately never `replaceEpicRunPolicy`: the client never reads,
+ * holds, or sends a whole policy, so a server-retained value it cannot see (the
+ * webhook URL) can never be dropped by a read-modify-write.
+ */
+export async function patchPolicy(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    const patch = request.mergePatch;
+    if (!patch ||
+        typeof patch !== "object" ||
+        Array.isArray(patch) ||
+        Object.keys(patch).length === 0) {
+        throw new ConductorBridgeApiError("invalid-input");
+    }
+    const parsed = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/patch-policy`, { merge_patch: patch }, fetchImpl);
+    return parsePatchPolicyResult(parsed);
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/resume-run` — body EXACTLY
+ * `{repo_name, clear_quarantine}`. No generation and no reason: the server
+ * re-reads the control record, re-evaluates activation, and owns the CAS retry.
+ */
+export async function resumeRun(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    if (typeof request.clearQuarantine !== "boolean") {
+        throw new ConductorBridgeApiError("invalid-input");
+    }
+    const parsed = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/resume-run`, { clear_quarantine: request.clearQuarantine }, fetchImpl);
+    return parseResumeRunResult(parsed);
+}
 /**
  * Idempotently seed an epic ticket status row via POST to the per-epic tickets
  * endpoint. The backend uses ON CONFLICT DO NOTHING so repeated seeding across

package/build/conductor/bring-up-facts.js

@@ -1,5 +1,5 @@
 /** The pinned operator runbook every remedy below points into. */
-export const BRING_UP_RUNBOOK = "docs/claude/epic-conductor-v2-operator-runbook.md";
+export const BRING_UP_RUNBOOK = "docs/claude/epic-implementer-v2-operator-runbook.md";
 /**
  * The client-derived refusal vocabulary, IN REFUSAL ORDER.
  *

package/build/conductor/claude-hook.js

@@ -87,10 +87,10 @@ export function mapClaudeHookEventToSemanticType(eventName) {
 }
 /** Conductor identity env required before any worker event may be emitted. */
 const REQUIRED_IDENTITY_ENV = [
-    "BAPI_CONDUCTOR_RUN_ID",
-    "BAPI_CONDUCTOR_WORKER_ID",
-    "BAPI_CONDUCTOR_TICKET_KEY",
-    "BAPI_CONDUCTOR_WORKTREE_PATH",
+    "BAPI_EPIC_IMPLEMENTER_RUN_ID",
+    "BAPI_EPIC_IMPLEMENTER_WORKER_ID",
+    "BAPI_EPIC_IMPLEMENTER_TICKET_KEY",
+    "BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH",
 ];
 function nonEmpty(value) {
     return typeof value === "string" && value.trim().length > 0;
@@ -100,7 +100,7 @@ function nonEmpty(value) {
  * the process environment, or `null` when the event is unmapped or the
  * conductor identity is incomplete.
  *
- * Identity gating: requires `BAPI_CONDUCTOR_ENABLED=1` and all of
+ * Identity gating: requires `BAPI_EPIC_IMPLEMENTER_ENABLED=1` and all of
  * {@link REQUIRED_IDENTITY_ENV}. Any missing value returns `null` WITHOUT
  * emitting — this prevents accidental emissions from unrelated worktrees that
  * happen to have the hook on PATH.
@@ -116,7 +116,7 @@ export function buildClaudeHookConductorEvent(payload, env) {
     if (type === null) {
         return null;
     }
-    if (env.BAPI_CONDUCTOR_ENABLED !== "1") {
+    if (env.BAPI_EPIC_IMPLEMENTER_ENABLED !== "1") {
         return null;
     }
     for (const key of REQUIRED_IDENTITY_ENV) {
@@ -124,14 +124,14 @@ export function buildClaudeHookConductorEvent(payload, env) {
             return null;
         }
     }
-    const ticketKey = env.BAPI_CONDUCTOR_TICKET_KEY.trim();
-    const worktreePath = env.BAPI_CONDUCTOR_WORKTREE_PATH.trim();
+    const ticketKey = env.BAPI_EPIC_IMPLEMENTER_TICKET_KEY.trim();
+    const worktreePath = env.BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH.trim();
     const details = {
         ticket_key: ticketKey,
         worktree_path: worktreePath,
     };
-    if (nonEmpty(env.BAPI_CONDUCTOR_REPO_NAME)) {
-        details.repo = env.BAPI_CONDUCTOR_REPO_NAME.trim();
+    if (nonEmpty(env.BAPI_EPIC_IMPLEMENTER_REPO_NAME)) {
+        details.repo = env.BAPI_EPIC_IMPLEMENTER_REPO_NAME.trim();
     }
     // The native payload lives ONLY under data.raw. Wrap non-object payloads so the
     // raw contract is always an object, never echoing native fields elsewhere.
@@ -142,8 +142,8 @@ export function buildClaudeHookConductorEvent(payload, env) {
         source: "claude-code",
         type,
         subject: ticketKey,
-        run_id: env.BAPI_CONDUCTOR_RUN_ID.trim(),
-        worker_id: env.BAPI_CONDUCTOR_WORKER_ID.trim(),
+        run_id: env.BAPI_EPIC_IMPLEMENTER_RUN_ID.trim(),
+        worker_id: env.BAPI_EPIC_IMPLEMENTER_WORKER_ID.trim(),
         producer: "claude-code-hook",
         observed_via: "claude-code-hook",
         data: {
@@ -176,21 +176,21 @@ export function buildConductorEmitEventArgs(event) {
 }
 /**
  * Resolve how to invoke `epic-implementer emit-event`. Prefers
- * `BAPI_CONDUCTOR_CLI_FILE` (run via the current Node executable so no global
- * install is required), otherwise falls back to `BAPI_CONDUCTOR_BIN` or the
+ * `BAPI_EPIC_IMPLEMENTER_CLI_FILE` (run via the current Node executable so no global
+ * install is required), otherwise falls back to `BAPI_EPIC_IMPLEMENTER_BIN` or the
  * bare `epic-implementer` binary on PATH — never the retained `conductor`
  * name, which is now a fixed migration stub (S4/BAPI-1080). `emitArgs` are
  * appended after the `emit-event` subcommand.
  */
 export function resolveConductorEmitCommand(env, emitArgs) {
-    const cliFile = env.BAPI_CONDUCTOR_CLI_FILE;
+    const cliFile = env.BAPI_EPIC_IMPLEMENTER_CLI_FILE;
     if (nonEmpty(cliFile)) {
         return {
             command: process.execPath,
             args: [cliFile.trim(), "emit-event", ...emitArgs],
         };
     }
-    const bin = nonEmpty(env.BAPI_CONDUCTOR_BIN) ? env.BAPI_CONDUCTOR_BIN.trim() : "epic-implementer";
+    const bin = nonEmpty(env.BAPI_EPIC_IMPLEMENTER_BIN) ? env.BAPI_EPIC_IMPLEMENTER_BIN.trim() : "epic-implementer";
     return { command: bin, args: ["emit-event", ...emitArgs] };
 }
 const defaultConductorSpawn = (command, args, input) => {

package/build/conductor/doctor.js

@@ -18,7 +18,7 @@ import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { resolveProfiles } from "../mcp-profile.js";
 import { createReadinessCheck, createReadinessCheckSafely, } from "../readiness-check.js";
 /**
- * Remediation for a conductor context whose resolved MCP groups omit `conductor`.
+ * Remediation for a conductor context whose resolved MCP groups omit `epic_implementer`.
  *
  * Fixed prose: it never interpolates the raw `BRIDGE_MCP_PROFILE` value. The
  * legacy warning does interpolate it (unchanged), but a consolidated report is a
@@ -26,7 +26,7 @@ import { createReadinessCheck, createReadinessCheckSafely, } from "../readiness-
  * gate needs to echo to name the fix. ADD, never replace — replacing the value
  * would drop the worker's other groups.
  */
-export const MCP_PROFILE_REMEDIATION = "ADD `conductor` to BRIDGE_MCP_PROFILE (comma-separated) — do NOT replace the existing value, " +
+export const MCP_PROFILE_REMEDIATION = "ADD `epic_implementer` to BRIDGE_MCP_PROFILE (comma-separated) — do NOT replace the existing value, " +
     "which would drop the worker's other tool groups. Without it the conductor/event/supervisor " +
     "tools are not registered.";
 /**
@@ -70,9 +70,10 @@ export const MCP_PROFILE_UNSET = "(unset)";
 /**
  * The CLI-only verbs that call the Bridge API from a shell-spawned process and
  * therefore resolve credentials themselves (CLAUDE.md "Shell-Spawned Credential
- * Resolution"): the four BAPI-872 recovery verbs and the three BAPI-1154 repair
- * verbs. `.mcp.json` env is invisible to them — only `BAPI_API_KEY` in the parent
- * env and the user-scoped credential store count.
+ * Resolution"): the four BAPI-872 recovery verbs and the six run-addressed repair
+ * verbs (BAPI-1154's three and BAPI-1176's three). `.mcp.json` env is invisible to
+ * them — only `BAPI_API_KEY` in the parent env and the user-scoped credential
+ * store count.
  */
 export const CREDENTIALED_RECOVERY_COMMANDS = [
     "stop-run",
@@ -82,6 +83,9 @@ export const CREDENTIALED_RECOVERY_COMMANDS = [
     "scope-reparse",
     "dispatch-remediation",
     "merge-child",
+    "scope-catch-up",
+    "patch-policy",
+    "resume-run",
 ];
 /** Remediation for recovery/repair verbs that cannot resolve Bridge credentials. */
 export const REPAIR_CREDENTIAL_REMEDIATION = "export BAPI_API_KEY in the shell that runs `conductor`, or store a credential for this " +
@@ -364,13 +368,13 @@ export async function collectConductorNativeLedgerSafe(deps = {}) {
 }
 /**
  * Inspect the BRIDGE_MCP_PROFILE environment variable and warn when a
- * conductor/epic context is detected but the resolved groups omit `conductor`.
+ * conductor/epic context is detected but the resolved groups omit `epic_implementer`.
  * Strictly read-only, never throws.
  *
  * BAPI-772: health is judged from {@link resolveProfiles} — the SAME resolver the
  * MCP server registers tools with — instead of comparing the raw string to
- * `"conductor"`. The old equality check called a worker running
- * `BRIDGE_MCP_PROFILE=conductor,sfcc` (exactly what `buildConductorWorkerEnv`
+ * `"epic_implementer"`. The old equality check called a worker running
+ * `BRIDGE_MCP_PROFILE=epic_implementer,sfcc` (exactly what `buildConductorWorkerEnv`
  * produces on SFCC projects) or `full` degraded, and its remediation told the
  * operator to REPLACE the variable — which would have destroyed the worker's
  * other groups. The remediation now says ADD.
@@ -380,15 +384,15 @@ export function inspectMcpProfile(env) {
     const raw_profile = raw === undefined ? MCP_PROFILE_UNSET : raw;
     const groups = resolveProfiles(raw);
     const active_groups = Array.from(groups);
-    const conductor_context_detected = env.BAPI_CONDUCTOR_ENABLED === "1" || env.BAPI_CONDUCTOR_ENABLED === "true";
-    const degraded = conductor_context_detected && !groups.has("conductor");
+    const conductor_context_detected = env.BAPI_EPIC_IMPLEMENTER_ENABLED === "1" || env.BAPI_EPIC_IMPLEMENTER_ENABLED === "true";
+    const retired_profile = raw?.split(",").some((token) => token.trim().toLowerCase() === "conductor") ?? false;
+    const degraded = retired_profile || (conductor_context_detected && !groups.has("epic_implementer"));
     const warnings = [];
     if (degraded) {
-        warnings.push(`BRIDGE_MCP_PROFILE is ${raw_profile} (active groups: ${active_groups.join(", ")}) ` +
-            `but a conductor context is active. ADD \`conductor\` to BRIDGE_MCP_PROFILE ` +
-            `(e.g. \`${raw_profile === MCP_PROFILE_UNSET ? "conductor" : `${raw_profile},conductor`}\`) — ` +
-            `do NOT replace the value, which would drop the worker's other groups. ` +
-            `Without it the conductor/event/supervisor tools are not registered.`);
+        warnings.push(`Epic Implementer MCP profile is inactive (active groups: ${active_groups.join(", ")}). ` +
+            (retired_profile ? "The retired conductor profile token is ignored. " : "") +
+            "ADD `epic_implementer` to BRIDGE_MCP_PROFILE (comma-separated); keep other valid groups. " +
+            "Without it the Epic Implementer tools are not registered.");
     }
     // Fixed state labels and the CLOSED active-group vocabulary only (BAPI-1055):
     // `resolveProfiles` yields nothing but recognized group names, so this detail
@@ -397,14 +401,14 @@ export function inspectMcpProfile(env) {
         degraded
             ? {
                 id: "mcp-profile",
-                label: "MCP conductor profile",
+                label: "Epic Implementer MCP profile",
                 status: "warn",
-                detail: `a conductor context is active but the resolved groups omit \`conductor\` (active: ${active_groups.join(", ")})`,
+                detail: `the resolved groups omit \`epic_implementer\` (active: ${active_groups.join(", ")})`,
                 remediation: MCP_PROFILE_REMEDIATION,
             }
             : {
                 id: "mcp-profile",
-                label: "MCP conductor profile",
+                label: "Epic Implementer MCP profile",
                 status: "pass",
                 detail: conductor_context_detected
                     ? `conductor context active; resolved groups: ${active_groups.join(", ")}`
@@ -648,6 +652,7 @@ export function formatConductorDoctorReport(report) {
     // value of `full` is healthy precisely because it resolves to a set containing
     // `conductor`.
     const profileTag = mcp_profile.degraded ? "[WARNING] degraded" : "[OK]";
+    lines.push("Epic Implementer MCP profile");
     lines.push(`raw profile:           ${mcp_profile.raw_profile}`);
     lines.push(`active groups:         ${mcp_profile.active_groups.join(", ")} ${profileTag}`);
     lines.push(`conductor context:     ${mcp_profile.conductor_context_detected}`);
@@ -746,7 +751,7 @@ export function formatConductorDoctorReport(report) {
 export const CONDUCTOR_READINESS_DESCRIPTORS = [
     { id: "ledger", label: "Conductor event ledger" },
     { id: "git-hooks", label: "Conductor git hooks" },
-    { id: "mcp-profile", label: "MCP conductor profile" },
+    { id: "mcp-profile", label: "Epic Implementer MCP profile" },
     { id: "gh-cli", label: "GitHub CLI availability" },
     { id: "gh-auth", label: "GitHub CLI authentication" },
     { id: "native-ledger", label: "Native ledger binding" },

package/build/conductor/epic-implementer-cli.js

@@ -24,7 +24,7 @@ import { ConductorValidationError, ConductorEpicTickV1FrozenError, toConductorEr
 import { emitConductorEvent, purgeConductorLedger, sendWorkerMessage, checkWorkerMessages, } from "./store.js";
 import { isDuplicateConstraintError } from "./producer-ledger.js";
 import { SEMANTIC_EVENT_TYPES } from "./taxonomy.js";
-import { DRIVER_CONTEXT_MAX_BYTES } from "./repair-contract.js";
+import { DRIVER_CONTEXT_MAX_BYTES, POLICY_PATCH_MAX_BYTES } from "./repair-contract.js";
 import { installConductorGitHooks, resolveConductorHookBin } from "./git-hooks.js";
 import { runFileScopeGuardCli } from "./file-scope-guard.js";
 import { runPostCommitHookProducer, runReferenceTransactionHookProducer } from "./git-producer.js";
@@ -94,6 +94,15 @@ export function getConductorUsage() {
         "  merge-child --epic-run-id <id> --pr <number>",
         "                       Merge the run's PR-bound child through the shared merge",
         "                       service; the server composes the head and gate identity.",
+        "  scope-catch-up --epic-run-id <id> --scope-id <scope> [--json]",
+        "                       Replay merges the run's OWN scope did not observe through the",
+        "                       guarded advance gate (no force). Refused if the scope is not the run's.",
+        "  patch-policy --epic-run-id <id> --patch-file <path> [--json]",
+        "                       Merge-patch (RFC 7396) the run's policy on the server. Protected",
+        `                       paths refused; patch at most POLICY_PATCH_MAX_BYTES = ${POLICY_PATCH_MAX_BYTES} bytes.`,
+        "  resume-run --epic-run-id <id> [--clear-quarantine] [--json]",
+        "                       Resume a paused run (a quarantined one only with --clear-quarantine);",
+        "                       activation is re-checked server-side. Active/no-control is a no-op.",
         "",
         "supervise options:",
         "  --run-id <id>             Run/session identifier to supervise (required)",
@@ -168,10 +177,16 @@ export function getConductorUsage() {
         "      --raw-json '{\"branch\":\"feature/x\",\"sha\":\"abc123\"}'",
         "  epic-implementer emit-event --type ci.failed --source ci \\",
         "      --payload-ref 'file:///tmp/ci-log.txt'",
-        "  epic-implementer emit-event --type merge.succeeded --source conductor-merge \\",
+        "  epic-implementer emit-event --type merge.succeeded --source epic-implementer-merge \\",
         "      --worker-id w1 --data-json '{\"summary\":\"auto-merged\",\"status\":\"succeeded\"}'",
         "  epic-implementer doctor --json",
         "  epic-implementer purge",
+        "  epic-implementer scope-catch-up --epic-run-id <id> --scope-id <scope>",
+        "      # a merge landed on epic/<KEY> that the scope never observed (unobserved_advance)",
+        "  epic-implementer patch-policy --epic-run-id <id> --patch-file required-checks.json",
+        "      # required_checks_empty_no_mode; the file holds {\"required_checks\":[\"conductor-ci / gate\"]}",
+        "  epic-implementer resume-run --epic-run-id <id>",
+        "      # a cap_wall_clock pause whose cause is now cleared",
         "",
         "epic-tick options:",
         "  --epic-key <KEY>          Epic key to supervise (required, non-empty)",
@@ -263,6 +278,10 @@ const VALID_COMMANDS = new Set([
     "scope-reparse",
     "dispatch-remediation",
     "merge-child",
+    // BAPI-1176: CLI-only run-addressed repair verbs — never registered as MCP tools.
+    "scope-catch-up",
+    "patch-policy",
+    "resume-run",
     // Private, and deliberately ABSENT from the usage text: `__hook-bin` exists as
     // the bundled-artifact regression guard for BAPI-772 (mirroring `plane
     // __entrypoint`), not as a supported operator workflow.
@@ -833,7 +852,7 @@ export function parseEpicTickArgs(argv) {
 /**
  * Default the PreToolUse hook ON for epic-dispatched workers so the supervisor
  * gets worker-liveness (`tool.intent`) signals without the operator having to
- * export `BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE=1` (BAPI-441/A1 finding).
+ * export `BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE=1` (BAPI-441/A1 finding).
  *
  * Both the child-env copy and the hook registration key off this SAME
  * parent-process env flag, read at dispatch time, so setting it once at the
@@ -843,8 +862,8 @@ export function parseEpicTickArgs(argv) {
  * `process.env`) and returns it.
  */
 export function applyEpicTickPreToolUseDefault(env = process.env) {
-    if (env.BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE === undefined) {
-        env.BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE = "1";
+    if (env.BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE === undefined) {
+        env.BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE = "1";
     }
     return env;
 }
@@ -1281,6 +1300,20 @@ export async function runEpicImplementerCli(argv) {
                 const { runMergeChildCommand } = await import("./recovery-cli.js");
                 return await runMergeChildCommand(parsed.argv);
             }
+            // BAPI-1176: three more run-addressed repair verbs — CLI-only, lazily
+            // imported like the rest, and dispatched before any MCP construction.
+            case "scope-catch-up": {
+                const { runScopeCatchUpCommand } = await import("./recovery-cli.js");
+                return await runScopeCatchUpCommand(parsed.argv);
+            }
+            case "patch-policy": {
+                const { runPatchPolicyCommand } = await import("./recovery-cli.js");
+                return await runPatchPolicyCommand(parsed.argv);
+            }
+            case "resume-run": {
+                const { runResumeRunCommand } = await import("./recovery-cli.js");
+                return await runResumeRunCommand(parsed.argv);
+            }
             default:
                 console.error('Error: Unknown command. Run "epic-implementer --help" for usage.');
                 return 1;

package/build/conductor/epic-reconcile.js

@@ -55,7 +55,7 @@ export function safeDiagnosticMessage(err, fallback) {
  *
  * Deliberately diagnostic. The `epic_ticket_status` vocabulary — `parsing`,
  * `needs_human` and the rest — is owned by the SERVER-side reconciler
- * (`api/library/epic_conductor/reconciler.py`), which is the single transition
+ * (`api/library/epic_implementer/reconciler.py`), which is the single transition
  * authority for it and already parks this exact condition through its ordinary
  * `_park_needs_human` commit point under the same `shadow_stale_deadline` reason.
  * This pass runs the legacy supervisor's own, narrower status vocabulary, and

package/build/conductor/epic-runtime.js

@@ -54,13 +54,13 @@ const ACTIVE_WORKER_STATUSES = new Set(["dispatched", "running"]);
  * Source + producer tags for the durable `parse.triggered` marker that the
  * parse-after-merge wait emits from the epic-tick process.
  */
-const PARSE_WAIT_EVENT_SOURCE = "conductor-supervisor";
+const PARSE_WAIT_EVENT_SOURCE = "epic-implementer-supervisor";
 const PARSE_WAIT_EVENT_PRODUCER = "epic-parse-wait";
 /**
  * BAPI-494: source + producer tags for the durable `merge.conflict` marker the
  * done-gate pass emits when a `ready_for_review` ticket's PR is un-mergeable.
  */
-const MERGE_CONFLICT_EVENT_SOURCE = "conductor-supervisor";
+const MERGE_CONFLICT_EVENT_SOURCE = "epic-implementer-supervisor";
 const MERGE_CONFLICT_EVENT_PRODUCER = "epic-mergeability";
 function defaultLeaseOwner() {
     return `epic-tick-${process.pid}`;
@@ -403,7 +403,7 @@ export async function runConductorDoneGatePass(ticketStatuses, deps) {
         }
         // Stamp the ticket's run_id and (when available) worker_id onto the emitted
         // gate.met via a per-ticket env override (observePrCiOnce reads
-        // BAPI_CONDUCTOR_RUN_ID/_WORKER_ID from env, env taking precedence). run_id
+        // BAPI_EPIC_IMPLEMENTER_RUN_ID/_WORKER_ID from env, env taking precedence). run_id
         // correlates the fold to the ticket. worker_id is attribution ONLY: BAPI-525
         // Change A removed the worker_id requirement from merge-identity extraction, so
         // a missing worker_id no longer blocks the merge — the backstop stamps real
@@ -456,8 +456,8 @@ export async function runConductorDoneGatePass(ticketStatuses, deps) {
         }
         const perTicketEnv = {
             ...deps.env,
-            ...(runId ? { BAPI_CONDUCTOR_RUN_ID: runId } : {}),
-            ...(workerId ? { BAPI_CONDUCTOR_WORKER_ID: workerId } : {}),
+            ...(runId ? { BAPI_EPIC_IMPLEMENTER_RUN_ID: runId } : {}),
+            ...(workerId ? { BAPI_EPIC_IMPLEMENTER_WORKER_ID: workerId } : {}),
         };
         try {
             const observeResult = await deps.observePrCi({
@@ -550,7 +550,7 @@ export async function runEpicTick(options, deps = {}) {
     // dispatch state. Without this guard, `correlateRunId` writes a `run_spawned` row
     // under the REAL dispatch_key, and the next real tick's `claimDispatchKey` returns
     // `already-spawned`, silently skipping the real worker spawn.
-    const isDryRun = env.BAPI_CONDUCTOR_DISPATCH_DRY_RUN === "1";
+    const isDryRun = env.BAPI_EPIC_IMPLEMENTER_DISPATCH_DRY_RUN === "1";
     const startMs = nowFn();
     // ---------------------------------------------------------------------------
     // Step 0: Resolve Bridge API access (offline / fail-closed guard)
@@ -1736,12 +1736,12 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         // The dispatch kind comes from the plan node's automation (start-tickets or
         // review-tickets); default to start-tickets when unspecified.
         const kind = automationMap.get(tk) ?? "start-tickets";
-        // Operator dry-run: when BAPI_CONDUCTOR_DISPATCH_DRY_RUN=1, dispatch resolves
+        // Operator dry-run: when BAPI_EPIC_IMPLEMENTER_DISPATCH_DRY_RUN=1, dispatch resolves
         // the spawn command + model routing but opens NO terminal, creates NO worktree,
         // and opens NO PR (start-tickets/review-tickets dryRun). The full loop dispatch
         // path (ready-set → claim key → dispatch → correlate run_id) still exercises;
         // dry-run rows carry no runId, so a synthetic one is substituted for correlation.
-        const dispatchDryRun = process.env.BAPI_CONDUCTOR_DISPATCH_DRY_RUN === "1";
+        const dispatchDryRun = process.env.BAPI_EPIC_IMPLEMENTER_DISPATCH_DRY_RUN === "1";
         // BAPI-507 (N-2): thread the ticket's declared file scope into the
         // IMPLEMENTATION dispatch identity only. A `review-tickets` node does not open
         // an implementation PR, so it gets no file-scope env (Step 8.5).
@@ -1850,11 +1850,11 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         if (cachedPlanVersion === 0) {
             throw new Error(`dispatchReviewSeam called before fetchPlan for epic ${ek} ticket ${tk}; cachedPlanVersion is 0`);
         }
-        const dispatchDryRun = process.env.BAPI_CONDUCTOR_DISPATCH_DRY_RUN === "1";
+        const dispatchDryRun = process.env.BAPI_EPIC_IMPLEMENTER_DISPATCH_DRY_RUN === "1";
         // Deliberately omit `dispatch_key` from the identity: the reconcile pass owns
         // the idempotent :review key claim (recordEpicDispatch with reviewRole) and the
         // run_spawned correlation. orchestrateReviewTickets still mints the run_id and
-        // injects BAPI_CONDUCTOR_RUN_ID into the review agent's environment, which is
+        // injects BAPI_EPIC_IMPLEMENTER_RUN_ID into the review agent's environment, which is
         // exactly the correlation channel the Python review orchestrator reads to stamp
         // the spec_review.* verdict event with this review run's id (Phase 2).
         const identity = {

package/build/conductor/errors.js

@@ -81,7 +81,7 @@ export class ConductorEpicTickV1FrozenError extends Error {
  *
  * Worker-facing ledger operations (`check_messages`, `wait_for_done_gate` event
  * emission) MUST execute through `conductor-bin.js` under the captured conductor
- * Node (`CONDUCTOR_NODE_PATH`) so the worker Node never loads the `better-sqlite3`
+ * Node (`EPIC_IMPLEMENTER_NODE_PATH`) so the worker Node never loads the `better-sqlite3`
  * native binary. When that runtime is missing or invalid, this error makes the
  * failure LOUD and structured rather than silently falling back to the worker
  * Node. The carried `reason`/`envVar` are the ONLY diagnostic surface — both are
@@ -240,8 +240,8 @@ export function toConductorErrorEnvelope(error) {
             message: "Conductor persistence is unavailable (the optional better-sqlite3 native module is not loaded). Conductor coordination features are disabled; core tools are unaffected.",
         };
     }
-    // Worker-ledger subprocess runtime failure (BAPI-527): CONDUCTOR_NODE_PATH /
-    // BAPI_CONDUCTOR_CLI_FILE is missing or invalid so the worker cannot reach the
+    // Worker-ledger subprocess runtime failure (BAPI-527): EPIC_IMPLEMENTER_NODE_PATH /
+    // BAPI_EPIC_IMPLEMENTER_CLI_FILE is missing or invalid so the worker cannot reach the
     // local ledger through the captured conductor Node. Surfaced as a retryable-
     // shaped 503 with a fixed, secret-free message plus a small non-secret details
     // bag (env_var + stable reason). NOTHING path/secret-bearing is echoed. This is

package/build/conductor/file-scope-guard.js

@@ -2,7 +2,7 @@
  * BAPI-507 (N-2): warn-only worker file-scope guard.
  *
  * Compares a branch's changed files against the planner-declared touched-file
- * set (delivered to the worker via `BAPI_CONDUCTOR_DECLARED_TOUCHED_FILES_JSON`)
+ * set (delivered to the worker via `BAPI_EPIC_IMPLEMENTER_DECLARED_TOUCHED_FILES_JSON`)
  * and warns when the diff strays outside that set. It is strictly warn-only /
  * fail-open: it NEVER blocks PR creation, mutates the branch, or exits non-zero.
  * A worker that implements a sibling's files (the N-2 over-reach observed in the
@@ -21,9 +21,9 @@
  */
 import { spawnSync } from "node:child_process";
 /** Env var carrying the compact JSON array of declared repo-relative paths. */
-export const DECLARED_TOUCHED_FILES_ENV = "BAPI_CONDUCTOR_DECLARED_TOUCHED_FILES_JSON";
+export const DECLARED_TOUCHED_FILES_ENV = "BAPI_EPIC_IMPLEMENTER_DECLARED_TOUCHED_FILES_JSON";
 /** Env var carrying the dispatched ticket key (used only to label warnings). */
-export const FILE_SCOPE_GUARD_TICKET_KEY_ENV = "BAPI_CONDUCTOR_TICKET_KEY";
+export const FILE_SCOPE_GUARD_TICKET_KEY_ENV = "BAPI_EPIC_IMPLEMENTER_TICKET_KEY";
 /** Base ref the branch diff is computed against. */
 export const FILE_SCOPE_GUARD_BASE_REF = "origin/main";
 /**
@@ -73,7 +73,7 @@ export function normalizeDeclaredTouchedFiles(list) {
     return Array.from(out).sort();
 }
 /**
- * Parse `BAPI_CONDUCTOR_DECLARED_TOUCHED_FILES_JSON` into a normalized
+ * Parse `BAPI_EPIC_IMPLEMENTER_DECLARED_TOUCHED_FILES_JSON` into a normalized
  * declaration. Returns an "unspecified" result on a missing, blank, invalid-JSON,
  * non-array, or empty (after normalization) value — the guard no-ops in every
  * such case.

package/build/conductor/git-ci-types.js

@@ -155,7 +155,7 @@ export function stableJsonHash(value) {
  * The two literals are exported as named constants so no consumer spells them
  * inline — a typo in one consumer would otherwise silently disagree with the
  * parser about which disposition is configured. The Python mirror lives in
- * `api/library/epic_conductor/epic_implementer_readiness.py` and must carry the same
+ * `api/library/epic_implementer/epic_implementer_readiness.py` and must carry the same
  * closed set.
  */
 export const VERDICTLESS_DISPOSITION_PARK = "park";

package/build/conductor/git-inspection.js

@@ -72,7 +72,7 @@ export function sanitizeGitRemoteUrl(url) {
 /**
  * Resolve the local worktree context: worktree root, git common dir, current
  * branch, HEAD SHA, sanitized origin remote, and repo identity. Repo name prefers
- * `BAPI_CONDUCTOR_REPO_NAME`, then `BAPI_REPO_NAME`, then the git root basename.
+ * `BAPI_EPIC_IMPLEMENTER_REPO_NAME`, then `BAPI_REPO_NAME`, then the git root basename.
  * Never throws — missing git simply yields a degraded context.
  */
 export function getGitWorktreeContext(options = {}) {
@@ -86,7 +86,7 @@ export function getGitWorktreeContext(options = {}) {
     const branch = branchRaw === null || branchRaw === "HEAD" ? null : branchRaw;
     const headSha = normalizeSha(firstLine(runGitCommand(["rev-parse", "HEAD"], { cwd })) ?? "");
     const remoteOrigin = sanitizeGitRemoteUrl(firstLine(runGitCommand(["config", "--get", "remote.origin.url"], { cwd })) ?? "");
-    const repo = normalizeRepoName(env.BAPI_CONDUCTOR_REPO_NAME) ??
+    const repo = normalizeRepoName(env.BAPI_EPIC_IMPLEMENTER_REPO_NAME) ??
         normalizeRepoName(env.BAPI_REPO_NAME) ??
         normalizeRepoName(basename(worktreePath)) ??
         "unknown";