@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/doctor.js

@@ -10,9 +10,14 @@
  * found/missing plus the exact per-OS manual install command for each missing one.
  *
  * The audience is security-conscious/corporate, so the doctor is STRICTLY
- * read-only: no `--fix`, no auto-install, no npm `postinstall`, no terminal
- * spawning, no MCP server startup. It only ever runs read-only PATH probes
- * (`which`/`where`, `bash --version`, `git rev-parse`) through the injected deps.
+ * read-only: no `--fix`, no auto-install, no npm `postinstall`, no interactive
+ * terminal spawning, no MCP server startup. Every child process it starts is a
+ * QUERY: read-only PATH probes (`which`/`where`, `bash --version`,
+ * `git rev-parse`) and, on a host that has generated executor service units, the
+ * one read-only session probe that section issues (`loginctl show-user
+ * --property=Linger` / `launchctl print gui/<uid>`, BAPI-1137). Nothing here can
+ * reach a mutating lifecycle verb — `enable-linger`, `bootstrap`, `start` and
+ * their kin exist in this file only as remediation TEXT the operator runs.
  */
 import { readdir, readFile, stat } from "fs/promises";
 import { spawn } from "child_process";
@@ -22,6 +27,8 @@ import { createDefaultStartTicketsDeps } from "./start-tickets.js";
 import { VERSION, BUILD_COMMIT } from "./version.generated.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, formatInstallStatusFallbackReport, resolveInstallDoctorTarget, } from "./install-doctor.js";
 import { codexHome, inspectBridgeCodexProfile } from "./codex-bridge-profile.js";
+import { resolveRoutingHost } from "./model-routing-host.js";
+import { modelRoutingPreferencesPath, readModelRoutingPreference } from "./model-routing-preferences.js";
 import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "./agent-launchers/executor-adapter-inspection.js";
 import { resolveExecutorAgentAdapter } from "./agent-launchers/executor-adapter-registry.js";
 import { parseDefaultOnEnvFlag } from "./env-flags.js";
@@ -29,17 +36,15 @@ import { createBridgeApiUrls } from "./bridge-api-urls.js";
 import { probeToolSurface } from "./tool-surface-gating.js";
 import { resolveBapiCredentials } from "./credential-store.js";
 import { resolveConductorBridgeApiAccess } from "./conductor/bridge-api-client.js";
-import { getLiveRepositoryConductors, getParseDispatcherHealth, } from "./implement-epic/bridge-client.js";
-import { resolveConductEpicStateDirectory } from "./implement-epic/checkpoint-store.js";
-import { isConductEpicLockOwnerAlive, parseConductEpicLock, } from "./implement-epic/lock.js";
+import { getLiveRepositoryConductors, getParseDispatcherHealth, } from "./epic-shared/bridge-client.js";
 import { resolveRequiredStartTicketsRepoName } from "./start-tickets-repo.js";
 import { collectWorkerContainmentDiagnostic, formatWorkerContainmentDiagnosticReport, } from "./worker-containment-diagnostic.js";
 import { BRIDGE_PACKAGE_NAME, describeLauncherReason, DUPLICATE_REGISTRATION_GUIDANCE, inspectLauncherConfigs, parseLauncherPin as parseSharedLauncherPin, } from "./launcher-config-inspection.js";
 import { MCP_SERVER_NAME, MCP_PACKAGE_NAME, } from "./mcp-identity.js";
 import { DEFAULT_AGENT_NAME, resolveAgentSpec, isAgentName, formatValidAgentNames, } from "./agent-registry.js";
-import { getDoctorPrereqDescriptors, probePrerequisite, resolveWorktrunkBinary, } from "./start-tickets-prereqs.js";
+import { getDoctorPrereqDescriptors, probePrerequisite, } from "./start-tickets-prereqs.js";
 import { resolveProfiles } from "./mcp-profile.js";
-import { executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, inspectExecutorServiceArtifact, EXECUTOR_SERVICE_BASE_URL_ENV, } from "./executor/index.js";
+import { executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, inspectExecutorServiceArtifact, inspectExecutorServiceDurability, EXECUTOR_SERVICE_BASE_URL_ENV, } from "./executor/index.js";
 import { DEFAULT_BAPI_BASE_URL } from "./executor/credentials.js";
 import { detectClaudeLogin, formatClaudeLoginAdvisory } from "./claude-login.js";
 import { validateBranchName } from "./base-ref.js";
@@ -1005,6 +1010,53 @@ export function formatToolSurfaceDiagnosticReport(diag) {
     lines.push("to observe surface changes; no project MCP configuration change is required.");
     return lines.join("\n");
 }
+// ---------------------------------------------------------------------------
+// Executor provisioning diagnostics (BAPI-688) — STRICTLY read-only.
+//
+// Enumerates the deterministic, convention-named executor service units this
+// package generates (`executor install-service`) and reports their non-secret
+// configuration plus credential readiness. It never writes, never runs a
+// MUTATING `launchctl`/`systemctl`/`loginctl` verb, and — like every advisory
+// section — never influences the doctor exit code.
+//
+// It does spawn ONE child process, and only on a host that already has such a
+// unit: the read-only session-durability query added by BAPI-1137, through
+// `defaultReadOnlyLifecycleRunner` below. That is a real change to this
+// section's behavior and is stated here rather than left to be discovered —
+// with no injected runner it issues none, and the fact degrades to
+// `unverifiable` rather than being guessed.
+//
+// Discovery is derived SOLELY from the fixed OS directory + filename prefix, not
+// from `.bridge/install-state.json`: install state is conductor install history,
+// not an artifact registry, so a unit written by hand or by another machine's
+// operator is still found, and a stale state entry never invents one.
+// ---------------------------------------------------------------------------
+/**
+ * Shell-free runner for the ONE read-only durability query this section issues
+ * (BAPI-1137).
+ *
+ * `shell: false` plus an argument ARRAY, matching every other service-manager
+ * invocation in this package: a uid or identifier is data here, never syntax.
+ * The probes it runs — `loginctl show-user --property=Linger`,
+ * `launchctl print gui/<uid>` — are queries; nothing in this file can reach a
+ * mutating lifecycle command. Output is captured only so the lifecycle module
+ * can map a recognized state token, and is never surfaced.
+ */
+function defaultReadOnlyLifecycleRunner(executable, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(executable, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk.toString("utf-8");
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString("utf-8");
+        });
+        child.on("error", reject);
+        child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout, stderr }));
+    });
+}
 /** Where generated units live, and how their filenames encode the executor id. */
 function resolveExecutorServiceConvention(platform, homeDir) {
     if (platform === "darwin") {
@@ -1097,6 +1149,36 @@ export async function collectExecutorServiceDiagnostics(deps) {
     const pathApi = path.posix;
     const units = [];
     const warnings = [];
+    // BAPI-1137 — the host-level durability prerequisite, probed ONCE per run
+    // rather than once per unit: lingering and the GUI login domain are properties
+    // of the host and the user, not of any particular unit. Without an injected
+    // read-only runner no command is issued at all and the fact stays
+    // `unverifiable`, so a caller that supplies no runner keeps a zero-probe run.
+    let durability = {
+        prerequisite: "unverifiable",
+        remediation: null,
+    };
+    if (deps.runLifecycleCommand) {
+        try {
+            const inspection = await inspectExecutorServiceDurability({
+                platform: deps.platform === "darwin" ? "darwin" : "linux",
+                // The durability probe addresses the USER's session/linger state, not
+                // a unit, so it needs neither a unit path nor a service identifier.
+                unitPath: "",
+                serviceIdentifier: "durability-probe",
+                uid: deps.uid ?? null,
+            }, deps.runLifecycleCommand);
+            durability = {
+                prerequisite: inspection.prerequisite,
+                remediation: inspection.remediation,
+            };
+        }
+        catch {
+            // Sanitized: a probe that throws leaves the fact unverifiable rather than
+            // surfacing exception text or inventing a state.
+            durability = { prerequisite: "unverifiable", remediation: null };
+        }
+    }
     for (const name of matching) {
         const unitPath = pathApi.join(convention.dir, name);
         const executorId = convention.idFromFilename(name) ?? name;
@@ -1120,12 +1202,33 @@ export async function collectExecutorServiceDiagnostics(deps) {
                 baseUrlClass: "missing",
                 repos: [],
                 credentials: [],
-                warnings: ["unit could not be read; its configuration cannot be verified."],
+                // A unit whose bytes could not be read establishes NOTHING about what it
+                // declares. `unverifiable`, never `confirmed-absent`.
+                noStandingGithubWriteCredential: "unverifiable",
+                warnings: [
+                    "unit could not be read; its configuration cannot be verified.",
+                    "regenerate it through durable-host mode (`install conductor`) if this persists.",
+                ],
             });
             continue;
         }
         const inspection = inspectExecutorServiceArtifact(convention.kind, content);
         const unitWarnings = [...inspection.problems];
+        // BAPI-1137 — the classification comes from the GENERATOR's shared helper,
+        // applied to the unit read off disk. doctor maintains no second notion of
+        // what "declares no GitHub write credential" means, so a unit this section
+        // calls compliant is exactly a unit the generator would agree to write.
+        const credentialDeclaration = inspection.noStandingGithubWriteCredential;
+        unitWarnings.push(...inspection.credentialDeclarationProblems);
+        if (credentialDeclaration === "present") {
+            unitWarnings.push("this unit declares something outside the closed durable-host contract — regenerate it " +
+                "through durable-host mode (`install conductor`) and remove the hand edit.");
+        }
+        else if (credentialDeclaration === "unverifiable") {
+            unitWarnings.push("this unit could only be parsed partially, so the no-standing-GitHub-write-credential " +
+                "property could not be established — regenerate it through durable-host mode " +
+                "(`install conductor`).");
+        }
         let baseUrlClass;
         if (!inspection.baseUrl) {
             baseUrlClass = "missing";
@@ -1153,10 +1256,24 @@ export async function collectExecutorServiceDiagnostics(deps) {
             baseUrlClass,
             repos: inspection.repos,
             credentials,
+            noStandingGithubWriteCredential: credentialDeclaration,
             warnings: unitWarnings,
         });
     }
-    return { status: "collected", units, warnings };
+    return { status: "collected", units, warnings, durability };
+}
+/**
+ * The rendered name of the BAPI-1137 credential diagnostic.
+ *
+ * Named for the NARROW claim it actually makes — the unit's own declarations —
+ * rather than something broader like "host holds no GitHub credential", which
+ * the check cannot support and an operator would reasonably read as covering
+ * their SSH keys, keychain, and `gh` login.
+ */
+export const EXECUTOR_UNIT_CREDENTIAL_DIAGNOSTIC_NAME = "unit-declares-no-github-write-credential";
+/** How each classification renders, once, so the three spellings cannot drift. */
+function formatCredentialDeclarationLine(classification) {
+    return `      ${EXECUTOR_UNIT_CREDENTIAL_DIAGNOSTIC_NAME}: ${classification}`;
 }
 /**
  * Render the advisory "Executor provisioning" section (pure formatting — no I/O).
@@ -1179,6 +1296,7 @@ export function formatExecutorServiceDiagnosticsReport(diagnostics) {
         lines.push(`      executor id: ${unit.executorId}`);
         lines.push(`      ${EXECUTOR_SERVICE_BASE_URL_ENV}: ${unit.baseUrl ?? "(absent)"} [${unit.baseUrlClass}]`);
         lines.push(`      repos: ${unit.repos.length > 0 ? unit.repos.join(", ") : "(none parsed)"}`);
+        lines.push(formatCredentialDeclarationLine(unit.noStandingGithubWriteCredential));
         for (const cred of unit.credentials) {
             lines.push(cred.resolved
                 ? `      credential ${cred.target}: resolved (source: ${cred.source})`
@@ -1188,11 +1306,52 @@ export function formatExecutorServiceDiagnosticsReport(diagnostics) {
             lines.push(`WARN  ${unit.path}: ${warning}`);
         }
     }
+    // The host-level durability prerequisite, rendered SEPARATELY from every unit
+    // above: it is a property of this host and user, and attaching it to a unit
+    // would imply the two were one fact.
+    lines.push("");
+    if (diagnostics.durability.prerequisite === "configured") {
+        lines.push("found durable session: configured — services keep running without an active login.");
+    }
+    else if (diagnostics.durability.prerequisite === "session-bound") {
+        // Deliberately NOT a "found" line. The prerequisite this platform can check
+        // is satisfied, but what it establishes is a login session, not logout
+        // durability, and saying otherwise would contradict launchd.
+        lines.push("WARN  durable session: session-bound — a login session exists, but it is NOT logout-durable.");
+        if (diagnostics.durability.remediation) {
+            lines.push(`      operator action: ${diagnostics.durability.remediation}`);
+        }
+        lines.push("      A LaunchAgent stops with the login it runs under; closing the lid or logging out", "      stops the executor. doctor performed a READ-ONLY query and changed nothing.");
+    }
+    else if (diagnostics.durability.prerequisite === "not-configured") {
+        lines.push("WARN  durable session: NOT durably configured for this host.");
+        if (diagnostics.durability.remediation) {
+            lines.push(`      remediation (operator-run): ${diagnostics.durability.remediation}`);
+        }
+        lines.push("      doctor performed a READ-ONLY query only: it did not run `loginctl enable-linger`,", "      change any session setting, or alter the exit code.");
+    }
+    else if (diagnostics.durability.prerequisite === "not-applicable") {
+        lines.push("SKIP  durable session: this platform has no session/linger prerequisite.");
+    }
+    else {
+        lines.push("SKIP  durable session: unverifiable — the read-only probe produced no recognized answer.", "      That is not evidence that this host is, or is not, durably configured.");
+    }
+    lines.push("");
+    lines.push("Unit-content compliance and service-manager state are INDEPENDENT facts: the manager may");
+    lines.push("still be running a previously loaded definition rather than the bytes currently on disk, so a");
+    lines.push("compliant unit file is not evidence about the running process, and neither is evidence that");
+    lines.push("Bridge has observed an executor claim.");
+    lines.push("");
+    lines.push(`The ${EXECUTOR_UNIT_CREDENTIAL_DIAGNOSTIC_NAME} fact covers the unit's OWN declarations —`);
+    lines.push("its environment keys and its arguments. Host-wide SSH keys and agents, login keychains, `gh`");
+    lines.push("login state, git credential helpers, and independently managed Claude worker authentication");
+    lines.push("are outside it and are never inspected or asserted here.");
     lines.push("");
     lines.push("Generated units carry only the base URL, the generating shell's PATH, repositories, and", "executor id — credentials resolve at");
     lines.push("launch time from BAPI_API_KEY or the user-scoped bapi:<repo> store, so no key value is stored on");
     lines.push("disk or printed here. Starting, stopping, and enabling a unit stay operator-managed. This section");
-    lines.push("is advisory and never changes the doctor exit code.");
+    lines.push("is advisory — including the credential-declaration and durable-session facts, which are excluded");
+    lines.push("from required-prerequisite computation — and never changes the doctor exit code.");
     return lines.join("\n");
 }
 export async function collectPlaneCredentialDiagnostic(deps) {
@@ -1311,175 +1470,6 @@ export function formatPlaneCredentialDiagnosticReport(diagnostic) {
     lines.push("           no .bridge/plane/ directory, persists nothing, and starts no plane member.");
     return lines.join("\n");
 }
-/**
- * Collect implement-epic readiness, read-only.
- *
- * The credential is resolved only to establish that it CAN be, and the resolved
- * access object is discarded immediately: only the repo name and a boolean
- * survive into the returned diagnostic, so no later formatting change can print
- * a key it never received.
- */
-export async function collectConductEpicDiagnostic(deps) {
-    const isAlive = deps.isProcessAlive ?? isConductEpicLockOwnerAlive;
-    let ghPresent = false;
-    let ghAuthenticated = false;
-    try {
-        const version = await deps.runCommand("gh", ["--version"], { cwd: deps.cwd });
-        ghPresent = version.exitCode === 0;
-    }
-    catch {
-        ghPresent = false;
-    }
-    if (ghPresent) {
-        try {
-            const auth = await deps.runCommand("gh", ["auth", "status"], { cwd: deps.cwd });
-            ghAuthenticated = auth.exitCode === 0;
-        }
-        catch {
-            ghAuthenticated = false;
-        }
-    }
-    const worktrunkBinary = resolveWorktrunkBinary(deps.platform, deps.env);
-    let worktrunkAvailable = false;
-    try {
-        const probe = await deps.runCommand(worktrunkBinary, ["--version"], { cwd: deps.cwd });
-        worktrunkAvailable = probe.exitCode === 0;
-    }
-    catch {
-        worktrunkAvailable = false;
-    }
-    const resolveAccess = deps.resolveAccess ?? resolveConductorBridgeApiAccess;
-    let repo = null;
-    let bridgeCredentialResolved = false;
-    try {
-        const result = await resolveAccess({
-            env: deps.env,
-            cwd: deps.cwd,
-            homedir: deps.homedir,
-            platform: deps.platform,
-            readFile: deps.readFile,
-            stat: deps.stat,
-        });
-        if (result.ok) {
-            repo = result.access.repoName;
-            bridgeCredentialResolved = true;
-        }
-    }
-    catch {
-        bridgeCredentialResolved = false;
-    }
-    let stateDirectory = null;
-    let stateDirectoryReadable = false;
-    const checkpoints = [];
-    const locks = [];
-    if (repo !== null) {
-        stateDirectory = resolveConductEpicStateDirectory(repo, {
-            env: deps.env,
-            homedir: deps.homedir,
-        });
-        let entries = [];
-        try {
-            entries = await deps.readdir(stateDirectory);
-            stateDirectoryReadable = true;
-        }
-        catch {
-            stateDirectoryReadable = false;
-        }
-        for (const entry of entries) {
-            if (entry.endsWith(".json"))
-                checkpoints.push(entry);
-            if (!entry.endsWith(".lock"))
-                continue;
-            const epic = entry.slice(0, -".lock".length);
-            let raw;
-            try {
-                raw = await deps.readFile(path.join(stateDirectory, entry));
-            }
-            catch {
-                locks.push({ epic, owner_pid: null, host: null, alive: null, problem: "unreadable" });
-                continue;
-            }
-            const owner = parseConductEpicLock(raw);
-            if (owner === null) {
-                locks.push({ epic, owner_pid: null, host: null, alive: null, problem: "malformed or unsupported version" });
-                continue;
-            }
-            // Liveness is only meaningful for a lock taken on THIS host.
-            const alive = owner.host === deps.env.HOSTNAME || owner.host === os.hostname()
-                ? isAlive(owner.owner_pid)
-                : null;
-            locks.push({ epic, owner_pid: owner.owner_pid, host: owner.host, alive });
-        }
-    }
-    return {
-        ghPresent,
-        ghAuthenticated,
-        worktrunkBinary,
-        worktrunkAvailable,
-        repo,
-        bridgeCredentialResolved,
-        stateDirectory,
-        stateDirectoryReadable,
-        checkpoints,
-        locks,
-    };
-}
-/** Render the implement-epic section. Advisory: never changes the exit code. */
-export function formatConductEpicDiagnosticReport(diagnostic) {
-    const lines = ["", "implement-epic readiness (advisory)"];
-    lines.push(diagnostic.ghAuthenticated
-        ? "  OK       gh: present and authenticated."
-        : diagnostic.ghPresent
-            ? "  MISSING  gh: present but NOT authenticated. Run `gh auth login`."
-            : "  MISSING  gh: not found on PATH. `implement-epic init` and `status` need it.");
-    lines.push(diagnostic.worktrunkAvailable
-        ? `  OK       Worktrunk: '${diagnostic.worktrunkBinary}' resolves.`
-        : `  MISSING  Worktrunk: '${diagnostic.worktrunkBinary}' not found (honors BAPI_WORKTRUNK_BIN).`);
-    if (diagnostic.repo === null) {
-        lines.push("  MISSING  Bridge identity: the repository could not be resolved. Set BAPI_REPO_NAME\n" +
-            "           or add a valid .bridge/config at the repository root.");
-    }
-    else if (diagnostic.bridgeCredentialResolved) {
-        lines.push(`  OK       Bridge credential for ${diagnostic.repo}: resolved.`);
-    }
-    else {
-        lines.push(`  MISSING  Bridge credential for ${diagnostic.repo}: NOT resolved.`);
-    }
-    if (diagnostic.stateDirectory === null) {
-        lines.push("  SKIP     Checkpoint directory: not resolved (no repository identity).");
-    }
-    else if (!diagnostic.stateDirectoryReadable) {
-        lines.push(`  SKIP     Checkpoint directory ${diagnostic.stateDirectory}: absent or unreadable\n` +
-            "           (normal before the first `implement-epic init`).");
-    }
-    else {
-        lines.push(`  OK       Checkpoint directory ${diagnostic.stateDirectory}: readable, ` +
-            `${diagnostic.checkpoints.length} checkpoint(s).`);
-    }
-    if (diagnostic.locks.length === 0) {
-        lines.push("  OK       Locks: none held.");
-    }
-    else {
-        for (const lock of diagnostic.locks) {
-            if (lock.problem !== undefined) {
-                lines.push(`  WARN     Lock ${lock.epic}: ${lock.problem}. Inspect it by hand.`);
-            }
-            else if (lock.alive === false) {
-                lines.push(`  WARN     Lock ${lock.epic}: owner pid ${lock.owner_pid} on ${lock.host} is gone (stale).\n` +
-                    "           The next mutating verb recovers it automatically.");
-            }
-            else if (lock.alive === null) {
-                lines.push(`  WARN     Lock ${lock.epic}: taken on host ${lock.host}; liveness is unknowable here.`);
-            }
-            else {
-                lines.push(`  OK       Lock ${lock.epic}: held by live pid ${lock.owner_pid}.`);
-            }
-        }
-    }
-    lines.push("           Read-only: this section probes commands and reads local state. It recovers no");
-    lines.push("           lock, rewrites no checkpoint, and never changes the exit code.");
-    return lines.join("\n");
-}
 /**
  * The transitional local helpers BAPI-1102 retires.
  *
@@ -1501,14 +1491,10 @@ export const LEGACY_DRIVE_HELPER_RELATIVE_PATHS = [
 /**
  * Collect the operational advisories, read-only.
  *
- * Local pilot conductors are identified from the SAME checkpoint-directory and
- * lock inspection `implement-epic readiness` uses — `parseConductEpicLock` plus the
- * injected liveness seam — never from the process table. Only a lock proven live
- * on THIS host counts; malformed, unreadable, dead, and remote-host locks are
- * excluded from the live set, with the indeterminate ones counted separately.
+ * Concurrent conductors and parse-dispatcher health are read from two read-only
+ * Bridge GETs; no local process table or lock directory is inspected.
  */
 export async function collectOperationalAdvisories(deps) {
-    const isAlive = deps.isProcessAlive ?? isConductEpicLockOwnerAlive;
     const now = deps.now ?? (() => new Date());
     const resolveAccess = deps.resolveAccess ?? resolveConductorBridgeApiAccess;
     let dispatcher = null;
@@ -1542,64 +1528,13 @@ export async function collectOperationalAdvisories(deps) {
             conductors.push(...live.value.conductors);
         }
     }
-    // Local pilot locks. Read through the same path the readiness section uses; a
-    // failure to read the directory is silence, not a claim that none are held.
-    let indeterminateLocks = 0;
-    if (repo !== null) {
-        const stateDirectory = resolveConductEpicStateDirectory(repo, {
-            env: deps.env,
-            homedir: deps.homedir,
-        });
-        let entries = [];
-        try {
-            entries = await deps.readdir(stateDirectory);
-        }
-        catch {
-            entries = [];
-        }
-        for (const entry of entries) {
-            if (!entry.endsWith(".lock"))
-                continue;
-            const epic = entry.slice(0, -".lock".length);
-            let raw;
-            try {
-                raw = await deps.readFile(path.join(stateDirectory, entry));
-            }
-            catch {
-                indeterminateLocks += 1;
-                continue;
-            }
-            const owner = parseConductEpicLock(raw);
-            if (owner === null) {
-                indeterminateLocks += 1;
-                continue;
-            }
-            const local = owner.host === deps.env.HOSTNAME || owner.host === os.hostname();
-            if (!local) {
-                indeterminateLocks += 1;
-                continue;
-            }
-            if (!isAlive(owner.owner_pid))
-                continue;
-            // A pilot lock and a v2 run are two DISTINCT conductor authorities. Even
-            // when both name the same epic they are not deduplicated — that pairing is
-            // precisely the overlap an operator most needs to see.
-            //
-            // The key comes from a FILENAME, so it is bounded against the epic-key shape
-            // before it is rendered; an unrecognized name reports `unknown` rather than
-            // putting arbitrary filesystem text into a diagnostic line.
-            conductors.push({
-                kind: "pilot",
-                epicKey: validateTicketKey(epic, "epic key").ok ? epic : null,
-                state: "lock held",
-                livenessSource: "lock",
-            });
-        }
-        if (conductors.length > 0 && conductorObservation !== "observed") {
-            conductorObservation = "observed";
-        }
-    }
     // BAPI-1102 — a pure path-presence check, using the SAME injected `stat` and
+    // (BAPI-1137) still ONLY a path-presence check: the helpers' CONTENTS are
+    // never read, they are never executed, and neither file is ever deleted. The
+    // guidance below names durable-host mode as their replacement; removing them
+    // stays an operator step, because they live outside this repository and
+    // product code that deleted files in `~/.local/bin` would be a far larger
+    // authority than a read-only diagnostic should hold.
     // `homedir` seams every other advisory here uses, so it stays deterministic
     // under test and reaches no real filesystem in one. A `stat` that throws is
     // "absent"; it is never retried, and a permission error is not reported as a
@@ -1620,7 +1555,6 @@ export async function collectOperationalAdvisories(deps) {
         dispatcher,
         conductorObservation,
         conductors,
-        indeterminateLocks,
         legacyDriveHelpers,
     };
 }
@@ -1658,10 +1592,6 @@ export function formatOperationalAdvisoryReport(diagnostic) {
         lines.push("           A distinct-epic overlap is informational and may be legitimate: separately\n" +
             "           scoped epics do not share transition authority.");
     }
-    if (diagnostic.indeterminateLocks > 0) {
-        lines.push(`           ${diagnostic.indeterminateLocks} local lock(s) could not be judged (remote host,\n` +
-            "           malformed, or unreadable) and are excluded from the live count.");
-    }
     // BAPI-1102. A WARN, never a failure, and deliberately separate from every
     // readiness signal above: a stale helper says nothing about whether this
     // repository's conductor works, so classifying it as a readiness problem would
@@ -1672,12 +1602,14 @@ export function formatOperationalAdvisoryReport(diagnostic) {
         for (const helper of diagnostic.legacyDriveHelpers) {
             lines.push(`           ${helper}`);
         }
-        lines.push("           These predate the scoped two-phase bring-up and are retired. Confirm\n" +
-            "           `drive-epic <EPIC> --plan-file <dag>` works for you, then remove them.\n" +
+        lines.push("           These predate the scoped two-phase bring-up and are retired. The supported\n" +
+            "           replacement is DURABLE-HOST MODE: run `install conductor` to plan, write, and\n" +
+            "           start the executor as a persistent service, then confirm\n" +
+            "           `drive-epic <EPIC> --plan-file <dag>` works for you, and remove them.\n" +
             "           doctor performed a PATH-PRESENCE check only: it did not run, read, or\n" +
             "           modify either file, and it cannot delete them for you.");
     }
-    lines.push("           Read-only: this section issues two Bridge GETs and reads local lock state. It");
+    lines.push("           Read-only: this section issues two Bridge GETs and reads no local state. It");
     lines.push("           runs NO command probe, repairs no scheduler, and never changes the exit code.");
     return lines.join("\n");
 }
@@ -1752,6 +1684,13 @@ export async function runDoctorCli(argv, overrides = {}) {
                 ? "Codex Bridge approval profile is an older unmodified managed version; the next spawned worker refreshes it before launch."
                 : `Codex Bridge approval profile ${profile.status}; spawned workers use existing Codex approvals. Run install --tools=codex --codex-profile=on to opt in.`);
     }
+    // Read-only personal routing diagnostics. The installer marker is a hint;
+    // an initialized MCP client identity takes precedence during real requests.
+    const routingHost = resolveRoutingHost(undefined, deps.env.BAPI_MCP_HOST_FAMILY);
+    log(`Model routing host marker: ${routingHost.warning ?? routingHost.family ?? "neutral"}.`);
+    const preferencePath = modelRoutingPreferencesPath(deps.homedir?.() ?? os.homedir());
+    const preference = await readModelRoutingPreference(deps.env.BAPI_REPO_NAME ?? "_doctor_unscoped_", "review_ticket", preferencePath);
+    log(`Personal model routing preference: ${preference.warning ?? preference.source}.`);
     log(formatDoctorPrereqSection(deps.platform, collection));
     // Executor-adapter section (BAPI-781). Advisory with respect to the EXIT CODE
     // — an unusable adapter is reported loudly but does not change doctor's
@@ -1916,6 +1855,13 @@ export async function runDoctorCli(argv, overrides = {}) {
                     ((p) => readFile(p, "utf-8")),
                 stat: overrides.executorService?.stat ?? injectedFs.stat ?? ((p) => stat(p)),
                 resolveCredentials: overrides.executorService?.resolveCredentials,
+                // BAPI-1137 — the durability prerequisite needs a uid and a read-only
+                // runner. `process.getuid` is absent on win32, where a null uid simply
+                // leaves the fact unverifiable rather than interpolating `undefined`
+                // into a domain target.
+                uid: overrides.executorService?.uid ??
+                    (typeof process.getuid === "function" ? process.getuid() : null),
+                runLifecycleCommand: overrides.executorService?.runLifecycleCommand ?? defaultReadOnlyLifecycleRunner,
             };
             const executorDiagnostics = await collectExecutorServiceDiagnostics(executorDeps);
             log(formatExecutorServiceDiagnosticsReport(executorDiagnostics));
@@ -1973,55 +1919,8 @@ export async function runDoctorCli(argv, overrides = {}) {
             }));
         }
     }
-    // Advisory implement-epic section (BAPI-803). Read-only, and — like every
-    // section above — it cannot change the exit code: `implement-epic init` enforces
-    // these same invariants at the point where they actually block, and someone who
-    // never conducts an epic should not see a failing doctor because of it.
-    //
-    // Skipped entirely on an unsupported platform. This section is the only
-    // advisory one that runs COMMAND probes (`gh`, Worktrunk), and doctor's
-    // standing contract is that an unsupported platform probes nothing at all —
-    // reporting on tooling for a `implement-epic` that cannot run there would buy
-    // nothing and break that contract.
-    if (overrides.conductEpic !== false && collection.ok) {
-        try {
-            const injectedFs = deps;
-            const conductDeps = {
-                env: overrides.conductEpic?.env ?? deps.env,
-                cwd: overrides.conductEpic?.cwd ?? deps.cwd,
-                platform: overrides.conductEpic?.platform ?? deps.platform,
-                homedir: overrides.conductEpic?.homedir ?? injectedFs.homedir ?? os.homedir,
-                readFile: overrides.conductEpic?.readFile ??
-                    injectedFs.readFile ??
-                    ((p) => readFile(p, "utf-8")),
-                stat: overrides.conductEpic?.stat ?? injectedFs.stat ?? ((p) => stat(p)),
-                readdir: overrides.conductEpic?.readdir ?? ((p) => readdir(p)),
-                runCommand: overrides.conductEpic?.runCommand ?? deps.runCommand,
-                resolveAccess: overrides.conductEpic?.resolveAccess,
-                isProcessAlive: overrides.conductEpic?.isProcessAlive,
-            };
-            log(formatConductEpicDiagnosticReport(await collectConductEpicDiagnostic(conductDeps)));
-        }
-        catch {
-            // Any unexpected failure still renders a sanitized advisory section rather
-            // than dropping it or leaking exception text.
-            log(formatConductEpicDiagnosticReport({
-                ghPresent: false,
-                ghAuthenticated: false,
-                worktrunkBinary: resolveWorktrunkBinary(deps.platform, deps.env),
-                worktrunkAvailable: false,
-                repo: null,
-                bridgeCredentialResolved: false,
-                stateDirectory: null,
-                stateDirectoryReadable: false,
-                checkpoints: [],
-                locks: [],
-            }));
-        }
-    }
-    // Advisory operational-advisories section (BAPI-963), placed immediately after
-    // `implement-epic readiness` because both are read by the same operator at the
-    // same moment — "can I conduct?" then "what else is already running?".
+    // Advisory operational-advisories section (BAPI-963). Read by the operator
+    // asking "what is already running?" right after the readiness sections above.
     //
     // Gated on `collection.ok` for the same reason the section above is: an
     // unsupported platform reports nothing. That gate is belt-and-braces here,
@@ -2044,9 +1943,7 @@ export async function runDoctorCli(argv, overrides = {}) {
                     injectedFs.readFile ??
                     ((p) => readFile(p, "utf-8")),
                 stat: overrides.operationalAdvisories?.stat ?? injectedFs.stat ?? ((p) => stat(p)),
-                readdir: overrides.operationalAdvisories?.readdir ?? ((p) => readdir(p)),
                 resolveAccess: overrides.operationalAdvisories?.resolveAccess,
-                isProcessAlive: overrides.operationalAdvisories?.isProcessAlive,
                 fetchImpl: overrides.operationalAdvisories?.fetchImpl,
                 now: overrides.operationalAdvisories?.now,
             };
@@ -2059,7 +1956,6 @@ export async function runDoctorCli(argv, overrides = {}) {
                 dispatcher: null,
                 conductorObservation: "unavailable",
                 conductors: [],
-                indeterminateLocks: 0,
                 // Empty, not omitted: a collection that failed has not established
                 // that a legacy helper is absent, and a fallback that CLAIMED to have
                 // checked would be the one kind of wrong answer worse than silence.