@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/executor/env.js

@@ -8,7 +8,9 @@
  * written BEFORE spawn — see `../mcp-provisioning.js` wiring in
  * `job-runner.ts`), never via env vars. This builder still omits
  * `BRIDGE_MCP_PROFILE` (an absent profile selects the intended `core` tool
- * group default), every `BAPI_CONDUCTOR_*` key, `CONDUCTOR_NODE_PATH` (the
+ * group default), every Epic Implementer env key under BOTH the supported
+ * `BAPI_EPIC_IMPLEMENTER_*` prefix and the legacy Conductor prefix (BAPI-1190),
+ * the worker Node-path key under both its supported and legacy spellings (the
  * shim's node executable is resolved into the registration's command/args at
  * provisioning time instead), and all secret-bearing keys. It constructs a
  * FRESH object from a strict allowlist of non-secret operational keys — it
@@ -55,6 +57,7 @@
 import { PR_BASE_BRANCH_ENV_VAR, WORKER_BRANCH_ENV_VAR } from "../pr-base-contract.js";
 import { DECLARED_TOUCHED_FILES_ENV, normalizeDeclaredTouchedFiles, } from "../conductor/file-scope-guard.js";
 import { INDEX_SCOPE_ENV_VAR, validateOptionalIndexScope } from "../index-scope-contract.js";
+import { EPIC_IMPLEMENTER_ENV_PREFIX, EPIC_IMPLEMENTER_NODE_PATH_ENV, LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX, LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV, } from "../epic-implementer-env.js";
 /** Non-secret operational keys forwarded to the worker when present. */
 const ALLOWED_ENV_KEYS = [
     "PATH",
@@ -116,7 +119,10 @@ const SECRET_NAME_FRAGMENTS = ["TOKEN", "SECRET", "PASSWORD", "API_KEY"];
  */
 export const EXPLICIT_DENY_KEYS = [
     "BRIDGE_MCP_PROFILE",
-    "CONDUCTOR_NODE_PATH",
+    EPIC_IMPLEMENTER_NODE_PATH_ENV,
+    // BAPI-1190: the legacy spelling stays denied so a stale ambient value from an
+    // older package can never reach a worker during a version-skew window.
+    LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV,
     "BAPI_API_KEY",
     // ANTHROPIC_API_KEY has NO passthrough exception (BAPI-791): it stays denied
     // absolutely, unlike CLAUDE_CODE_OAUTH_TOKEN below, which is denied here too
@@ -164,15 +170,78 @@ export const EXPLICIT_DENY_KEYS = [
     // the allowlist.
     ...WORKER_SENTINEL_DATABASE_ENV_KEYS,
 ];
+// ---------------------------------------------------------------------------
+// Executor-PROCESS GitHub credential deny-list (BAPI-1137, R-4)
+//
+// Everything above this line governs what reaches a spawned WORKER. This block
+// governs the executor process itself, and it exists because the worker
+// allowlist cannot reach far enough: a manager-level environment injection — a
+// `launchctl setenv`, a systemd drop-in, a `~/.zprofile` that ran before the
+// operator started the executor by hand — puts a GitHub write token in the
+// executor's own environment, where a subprocess that builds its own environment
+// (or any future code path that reads one) could still find it.
+//
+// The durable-host claim is that the host holds NO STANDING GitHub write
+// credential. A unit that declares none (see `service-unit.ts`) and a process
+// that scrubs any it inherited are the two halves of that claim; without the
+// second, the first only proves the token did not come from the file Bridge
+// generated.
+// ---------------------------------------------------------------------------
+/**
+ * The GitHub write-credential variable names the executor process refuses to
+ * carry. Exactly the two names this repository's environment-safety conventions
+ * already recognize (`EXPLICIT_DENY_KEYS` above denies the same pair for a
+ * worker), so there is ONE vocabulary for "a GitHub write credential" rather
+ * than a second, drifting list.
+ */
+export const EXECUTOR_PROCESS_GITHUB_CREDENTIAL_DENY_KEYS = [
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+];
+/**
+ * Delete every prohibited GitHub credential variable from the executor's own
+ * environment, and report only HOW MANY were removed.
+ *
+ * Three properties are load-bearing and are what the return type is shaped
+ * around:
+ *
+ *  - **Names are compared case-insensitively.** `GH_TOKEN`, `gh_token`, and
+ *    `Gh_Token` are the same variable to a shell on a case-preserving platform,
+ *    and a scrubber that matched only the canonical spelling would leave the
+ *    other two in place.
+ *  - **Values are never read.** Nothing here dereferences a prohibited key
+ *    before deleting it, so no credential value can be logged, returned,
+ *    compared, or classified — not even as "looks like a PAT". A count is the
+ *    most a caller can learn.
+ *  - **It mutates in place.** The executor spawns children that inherit
+ *    `process.env`; returning a filtered COPY would leave the real environment
+ *    untouched and the guarantee imaginary.
+ */
+export function scrubExecutorProcessGithubCredentials(env = process.env) {
+    const prohibited = new Set(EXECUTOR_PROCESS_GITHUB_CREDENTIAL_DENY_KEYS.map((key) => key.toUpperCase()));
+    let removedCount = 0;
+    // A snapshot of the key names, because deleting while iterating the live
+    // object is exactly the kind of thing that silently skips an entry.
+    for (const key of Object.keys(env)) {
+        if (!prohibited.has(key.toUpperCase()))
+            continue;
+        delete env[key];
+        removedCount++;
+    }
+    return { removedCount };
+}
 /**
  * True only when `key` is a safe, allowlisted operational key. Exported so the
  * allowlist is locally auditable/testable. A key is allowed iff it is in the
- * allowlist AND is not explicitly denied, does not begin with `BAPI_CONDUCTOR_`,
- * and does not contain a secret-name fragment.
+ * allowlist AND is not explicitly denied, does not begin with the supported
+ * `BAPI_EPIC_IMPLEMENTER_` prefix or the legacy Conductor prefix, and does not
+ * contain a secret-name fragment.
  *
- * The `BAPI_CONDUCTOR_` rejection is a WHOLE-PREFIX rule, not an enumerated list,
- * which is what makes it hold for keys added later. BAPI-722's
- * `BAPI_CONDUCTOR_DENY_PROBE_TIMEOUT_MS` is rejected twice over — it is absent from
+ * Both prefix rejections are WHOLE-PREFIX rules, not enumerated lists, which is
+ * what makes them hold for keys added later. BAPI-1190 keeps the legacy prefix
+ * rejected alongside the renamed one, so a stale name inherited during a
+ * version-skew window is filtered too. BAPI-722's
+ * `BAPI_EPIC_IMPLEMENTER_DENY_PROBE_TIMEOUT_MS` is rejected twice over — it is absent from
  * `ALLOWED_ENV_KEYS` and it carries the prefix — so it stays executor-process
  * configuration and can never reach a spawned worker. That is deliberate: a worker
  * runs no deny probe, and letting job-side state influence the executor's own
@@ -183,7 +252,9 @@ export function isExecutorEnvKeyAllowed(key) {
         return false;
     if (EXPLICIT_DENY_KEYS.includes(key))
         return false;
-    if (key.startsWith("BAPI_CONDUCTOR_"))
+    if (key.startsWith(EPIC_IMPLEMENTER_ENV_PREFIX))
+        return false;
+    if (key.startsWith(LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX))
         return false;
     const upper = key.toUpperCase();
     if (SECRET_NAME_FRAGMENTS.some((fragment) => upper.includes(fragment)))

package/build/executor/heartbeat.js

@@ -22,7 +22,7 @@
  *    interval. This is TELEMETRY ONLY (R14): the marker is never persisted, never
  *    reported as `last_commit_sha`, and never drives an executor decision — the
  *    reconciler remains the sole consumer and the sole transition authority
- *    (`docs/claude/conductor-standing-rules.md`).
+ *    (`docs/claude/epic-implementer-standing-rules.md`).
  *
  *  - SERVER STOP (WS-B executor half). A heartbeat response carrying the
  *    server's stop request kills the owned worker like `stale_claim` does, but

package/build/executor/index.js

@@ -7,16 +7,33 @@
  */
 export { runExecutorCli, getExecutorUsage, parseExecutorArgs } from "./cli.js";
 export { runExecutor } from "./runner.js";
-// Persistent-service packaging (BAPI-688). The CLI entry plus the PURE helpers
-// doctor needs to enumerate and inspect generated units — doctor must share this
+// Persistent-service packaging (BAPI-688), the file-generation leg of
+// durable-host mode (BAPI-1137). The CLI entry plus the PURE helpers doctor
+// needs to enumerate and inspect generated units — doctor must share this
 // module's naming/format contract instead of maintaining a second parser.
+//
+// This group grants GENERATION only. It confers no lifecycle capability, which
+// is why the lifecycle exports stay in their own group below: a caller that
+// imports the generator still cannot start a persistent daemon.
 export { runExecutorInstallServiceCli, getExecutorInstallServiceUsage, buildExecutorServiceArtifact, writeExecutorServiceArtifact, inspectExecutorServiceArtifact, executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, 
 // Programmatic, lifecycle-free plan/write seam (BAPI-779) — how
 // `install conductor` reaches the generator without shelling out to the CLI.
-planExecutorServiceInstall, writeExecutorServicePlan, resolvePackagedExecutorInvocation, EXECUTOR_SERVICE_BASE_URL_ENV, EXECUTOR_SERVICE_PATH_ENV, } from "./service-unit.js";
+planExecutorServiceInstall, writeExecutorServicePlan, resolvePackagedExecutorInvocation, 
+// Durable-host credential declaration contract (BAPI-1137, R-4). doctor needs
+// the shared inspector and the postcondition helper so its diagnostic and the
+// generator's write check are literally the same rule; exporting the allowlist
+// and the argument-contract predicate keeps the contract locally auditable
+// rather than discoverable only by reading the renderer.
+inspectExecutorServiceCredentialDeclaration, assertExecutorServiceCredentialPostcondition, checkExecutorServiceArgumentContract, isAllowedExecutorServiceUnitEnvKey, executorLaunchdLogPathsForId, EXECUTOR_SERVICE_BASE_URL_ENV, EXECUTOR_SERVICE_PATH_ENV, EXECUTOR_SERVICE_UNIT_ENV_ALLOWLIST, EXECUTOR_SERVICE_UNIT_FILE_MODE, } from "./service-unit.js";
 // Consented lifecycle (BAPI-779, R-1). Deliberately a SEPARATE module from the
 // generator above: importing the writer never grants the ability to start a
 // persistent daemon.
-export { buildExecutorServiceStartPlan, buildExecutorServiceStateProbe, formatExecutorServiceStartFailure, inspectExecutorServiceState, startExecutorService, } from "./service-lifecycle.js";
+export { buildExecutorServiceStartPlan, buildExecutorServiceStateProbe, formatExecutorServiceStartFailure, inspectExecutorServiceState, startExecutorService, 
+// Durability prerequisites (BAPI-1137). Exported SEPARATELY from the
+// generation group above, and alongside — not inside — the start group: these
+// are strictly read-only probes, so importing them grants the ability to ASK
+// whether this host survives logout, never the ability to change it. Nothing
+// here runs `loginctl enable-linger`.
+buildExecutorServiceDurabilityProbe, inspectExecutorServiceDurability, EXECUTOR_LINGER_REMEDIATION, EXECUTOR_MACOS_SESSION_REMEDIATION, } from "./service-lifecycle.js";
 export { collectExecutorInstallPreflight, formatExecutorInstallPreflight, EXECUTOR_INSTALL_REQUIRED_TOOLS, EXECUTOR_INSTALL_CLAUDE_LOGIN_REMEDIATION, } from "./install-preflight.js";
 export { runExecutorWatchCli, getExecutorWatchUsage, parseExecutorWatchArgs, } from "./watch-cli.js";

package/build/executor/job-errors.js

@@ -143,12 +143,12 @@ export const WorkerEnvFilePresent = "ContractError.WorkerEnvFilePresent";
  * BAPI-1152 — `reconcile_overlap` failure kinds. Each names ONE way the
  * wrapper's merge-into-child could not reach a verified push, so an operator
  * reading the row knows which fact to go look at. None of them is a verdict: a
- * refused governance change and a moved head are NOT failures — they complete
- * with a fact envelope — so they have no kind here.
+ * moved head is NOT a failure — it completes with a fact envelope — so it has
+ * no kind here.
  *
  *  - `ContractError.ReconcileOverlapPayload` — the payload failed validation
  *    before any subprocess ran (missing/blank input SHA, unknown schema version,
- *    malformed command or region record).
+ *    malformed command record).
  *  - `ContractError.ReconcileOverlapBranchMismatch` — the prepared worktree's
  *    branch is not the job's top-level `expected_branch`, so the push destination
  *    cannot be trusted.

package/build/executor/job-runner.js

@@ -19,6 +19,7 @@ import os from "node:os";
 import { runHeartbeatLoop } from "./heartbeat.js";
 import { isExecutorNamedError, toExecutorFailure, secretFreeErrorMessage, MissingVerdictArtifact, PreSpawnVerification, RequiredMcpRegistration, McpSurfaceMismatch, WorkerStartupFatal, WORKER_STARTUP_FATAL_MESSAGE, formatMcpSurfaceMismatch, ClaudeNotAuthenticated, CLAUDE_NOT_AUTHENTICATED_MESSAGE, ExecutorAdapterUnavailable, ExecutorNamedError, WorktreeBusy, StaleArtifactCleanupFailed, WORKTREE_BUSY_MESSAGE, WorkerEnvFilePresent, WORKER_ENV_FILE_PRESENT_MESSAGE, } from "./job-errors.js";
 import { buildConductorMergeAccessForExecutorJob, buildDefaultMergeLocalDeps, runExecutorMergeJob, MERGE_RETRYABLE, MERGE_FAILED, } from "./merge-job.js";
+import { createProductionCiRerunDeps, runCiRerunJob, } from "./ci-rerun-job.js";
 import { createObservationState } from "./observation.js";
 import { getWorktreeMcpRegistrationTargets, normalizeWorktreePathForRegistration, provisionMcpRegistrationForWorktree, } from "../mcp-provisioning.js";
 import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
@@ -615,6 +616,16 @@ control) {
     if (job.job_type === "smoke") {
         return runSmokeJob(job, httpClient, options, deps, ownership, observation, control);
     }
+    // BAPI-1160: `ci_rerun` is a deterministic executor action, dispatched here
+    // beside `merge`/`smoke` and BEFORE the generic spawn path. It ensures no
+    // worktree and spawns no worker, and it must NEVER fall back to one: spawning
+    // an LLM worker to "fix" a failure the server already proved to be
+    // infrastructure is exactly the behavior this job type replaces. `job-types.ts`
+    // keeps it out of both `SPAWN_JOB_TYPES` and `RECOVERY_JOB_TYPES`, so reaching
+    // the spawn path below is structurally impossible rather than merely unlikely.
+    if (job.job_type === "ci_rerun") {
+        return runCiRerunExecutorJob(job, httpClient, options, deps, ownership, observation, seams, control);
+    }
     // BAPI-1152: `reconcile_overlap` takes its OWN branch, after `merge`/`smoke`
     // and before the generic spawn path. It needs a prepared, locked worktree like
     // a spawn job, but its body is the reconcile module's state machine: the
@@ -652,6 +663,121 @@ control) {
     });
     return { status: "failed", reason: "unsupported_job_type" };
 }
+/**
+ * Run a deterministic `ci_rerun` job (BAPI-1160).
+ *
+ * Supervised through the SAME ownership, heartbeat, dead-man, and timeout
+ * protocol as {@link runMergeJob} — via {@link createFlowProcess} — so a
+ * deterministic job is not a second, weaker lifecycle. The body itself spawns no
+ * subprocess of its own beyond the bounded `gh` invocations inside
+ * `ci-rerun-job.ts`, and there is NO fallback to a worker on failure.
+ *
+ * The completion carries only the job's fact envelope. It names no gate,
+ * requests no transition, and asserts no verdict: the reconciler re-observes the
+ * head independently and remains the sole transition authority (R14 rule 3).
+ */
+async function runCiRerunExecutorJob(job, httpClient, options, deps, ownership, observation, seams, control) {
+    // Resolve + enforce payload.timeout_seconds BEFORE any provider work, exactly
+    // as the merge branch does.
+    const timeout = resolveJobTimeoutSeconds(job, options.defaultJobTimeoutSeconds);
+    if (!timeout.ok) {
+        await httpClient.fail(job, {
+            error_kind: "ContractError.Timeout",
+            error_message: timeout.error,
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "timeout_contract" };
+    }
+    const runCiRerun = seams.runCiRerun ??
+        ((payload) => runCiRerunJob(payload, createProductionCiRerunDeps()));
+    const flow = createFlowProcess(() => runCiRerun(job.payload), (result) => result.ok);
+    const procResult = await superviseProcess({
+        job,
+        httpClient,
+        options,
+        deps,
+        ownership,
+        observation,
+        proc: flow.proc,
+        timeoutSeconds: timeout.timeoutSeconds,
+        collectTelemetry: async () => ({}),
+        control,
+    });
+    if (ownership.abandoned) {
+        return { status: "abandoned", reason: ownership.abandonReason };
+    }
+    if (procResult.classification === "timeout") {
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "fail",
+            send: () => httpClient.fail(job, {
+                error_kind: "CiRerunFailed",
+                error_message: "ci_rerun exceeded its job timeout",
+                classification: "timeout",
+                telemetry: observation.snapshot(),
+            }),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "failed");
+    }
+    const outcome = flow.getOutcome();
+    if (outcome === undefined) {
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "fail",
+            send: () => httpClient.fail(job, {
+                error_kind: "CiRerunFailed",
+                error_message: "ci_rerun completed without an outcome",
+                classification: "crashed",
+                telemetry: observation.snapshot(),
+            }),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "failed");
+    }
+    if (outcome.ok) {
+        const completion = {
+            job_type: "ci_rerun",
+            exit_code: 0,
+            classification: "clean_exit",
+            // The FACT ENVELOPE, verbatim. No gate, no transition, no verdict — the
+            // backend model is `extra="forbid"`, so anything else fails validation
+            // rather than being silently ignored.
+            result: outcome.result,
+            telemetry: observation.snapshot(),
+        };
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "complete",
+            send: () => httpClient.complete(job, completion),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "completed");
+    }
+    // A refused or failed re-run. The reserved infrastructure attempt stays
+    // CONSUMED — see `ci-rerun-job.ts` — and the reason is a closed token, never
+    // provider text.
+    const terminal = await sendTerminalMutationWithAuthReport({
+        kind: "fail",
+        send: () => httpClient.fail(job, {
+            error_kind: outcome.failure.errorKind,
+            error_message: outcome.failure.reason,
+            classification: "crashed",
+            telemetry: observation.snapshot(),
+        }),
+        deps,
+        options,
+        ownership,
+        log: deps.log,
+    }, job, control);
+    return terminalToRunResult(terminal, "failed");
+}
 /**
  * Adapt a `runMerge(...)` promise into an {@link OwnedChildProcess} so the merge
  * flow is supervised by the SAME heartbeat/deadman/timeout path as spawn/smoke
@@ -2114,7 +2240,7 @@ async function runPreparedSpawn(params) {
     }
     const git = observation.git();
     // BAPI-1152: a driver owns everything after a clean worker exit — staging, the
-    // governance scan, the commits, the guarded push, and finalization.
+    // commits, the guarded push, and finalization.
     if (driver && procResult.classification === "clean_exit") {
         await finalizeRegistry();
         const phase = await superviseDriverPhase({

package/build/executor/job-types.js

@@ -26,6 +26,15 @@
  * resolution, but it does NOT re-enter `/implement-ticket`: it always carries an
  * explicit server-rendered `payload.prompt`, which wins over the synthesis in
  * `worker-command.ts`, and `job-runner.ts` dispatches it to its own body.
+ *
+ * BAPI-1160: `ci_rerun` is DELIBERATELY ABSENT from this set and from
+ * `SPAWN_JOB_TYPES` below. It is a deterministic actuator — one bounded
+ * `gh run rerun --failed` and a bounded poll — with no worktree, no branch to
+ * reuse, no prompt, and no worker. It has a dedicated dispatch branch in
+ * `job-runner.ts` beside `merge` and `smoke`, ahead of the generic spawn path,
+ * and it must NEVER fall back to a worker subprocess: spawning an LLM worker to
+ * "fix" a failure the server already PROVED to be infrastructure is the exact
+ * behavior this job type exists to replace.
  */
 export const RECOVERY_JOB_TYPES = new Set([
     "remediate",
@@ -37,8 +46,9 @@ export const RECOVERY_JOB_TYPES = new Set([
  * Real headless-spawn job types (worktree + worker LLM): the first-pass
  * `implement`, the `resume` continuation (own pre-spawn protocol), the
  * `spec_review` verdict job, and the recovery jobs. `merge` (deterministic,
- * no worktree/worker) and `smoke` (no-op acceptance) are intentionally EXCLUDED —
- * they have dedicated dispatch branches BEFORE the generic spawn path.
+ * no worktree/worker), `smoke` (no-op acceptance), and BAPI-1160's `ci_rerun`
+ * (deterministic, no worktree/worker) are intentionally EXCLUDED — they have
+ * dedicated dispatch branches BEFORE the generic spawn path.
  *
  * BAPI-1152: `reconcile_overlap` is here because it needs a prepared, locked
  * worktree and MAY spawn a worker — but only CONDITIONALLY. A clean merge whose

package/build/executor/merge-job.js

@@ -21,7 +21,7 @@
  *    {@link MERGE_FAILED} `error_kind` (via {@link classifyMergeFailureErrorKind})
  *    so the companion re-fire lane can route retry-vs-rebase without string parsing.
  */
-import { makeLocalMergeExecutor, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
+import { makeLocalMergeExecutor, resolveLocalMergeCredential, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
 import { resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
 import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, EPIC_BRANCH_PREFIX, } from "../epic-integration-pr.js";
 import { secretFreeErrorMessage } from "./job-errors.js";
@@ -166,6 +166,30 @@ export const MERGE_RETRYABLE = "MergeRetryable";
 export const MERGE_CONFLICT = "MergeConflict";
 export const MERGE_FAILED = "MergeFailed";
 export const MERGE_REF_MISMATCH = "MergeRefMismatch";
+/**
+ * BAPI-1234 — the server's migration-graph merge guard refused the merge. Two
+ * kinds, kept distinct because they call for different human responses:
+ *  - {@link MERGE_MIGRATION_GRAPH_INVALID}: merging this head onto the current
+ *    base produces a broken Alembic graph. A human renumbers the PR's own
+ *    never-applied migration.
+ *  - {@link MERGE_MIGRATION_GRAPH_UNREADABLE}: the merged graph could not be
+ *    proven either way. An operator checks the provider, then unparks.
+ * Like {@link MERGE_REF_MISMATCH}, both are deliberate terminal refusals: never
+ * retryable, never a rebase target, and reported as `clean_exit`.
+ */
+export const MERGE_MIGRATION_GRAPH_INVALID = "MergeMigrationGraphInvalid";
+export const MERGE_MIGRATION_GRAPH_UNREADABLE = "MergeMigrationGraphUnreadable";
+/** Server refusal reasons mapped to their dedicated terminal error kinds. */
+const MIGRATION_GRAPH_ERROR_KINDS = new Map([
+    ["migration_graph_invalid", MERGE_MIGRATION_GRAPH_INVALID],
+    ["migration_graph_unreadable", MERGE_MIGRATION_GRAPH_UNREADABLE],
+]);
+/** Error kinds that are deliberate refusals rather than crashes. */
+const DELIBERATE_REFUSAL_ERROR_KINDS = new Set([
+    MERGE_REF_MISMATCH,
+    MERGE_MIGRATION_GRAPH_INVALID,
+    MERGE_MIGRATION_GRAPH_UNREADABLE,
+]);
 /** Reasons whose failure is transient/infrastructure and safe to retry. */
 const RETRYABLE_MERGE_REASONS = new Set([
     "gh_pr_view_timeout",
@@ -190,6 +214,9 @@ const RETRYABLE_MERGE_REASONS = new Set([
  * variants covered so a distinct reason never accidentally downgrades to
  * {@link MERGE_FAILED}. Conflict classification is checked first so it is never masked.
  *
+ * BAPI-1234: `migration_graph_invalid` / `migration_graph_unreadable` map to
+ * their own terminal kinds, in the same early position and for the same reason.
+ *
  * BAPI-1021: `ref_mismatch` is classified BEFORE conflict, retryable-prefix, and
  * generic-failure handling, and is deliberately NEVER added to
  * {@link RETRYABLE_MERGE_REASONS} — it is a terminal safety refusal, not a
@@ -201,6 +228,9 @@ export function classifyMergeFailureErrorKind(response) {
     const reason = asString(response.reason ?? undefined);
     if (reason === "ref_mismatch")
         return MERGE_REF_MISMATCH;
+    const migrationGraphKind = reason ? MIGRATION_GRAPH_ERROR_KINDS.get(reason) : undefined;
+    if (migrationGraphKind)
+        return migrationGraphKind;
     if (hasConflictEvent || reason === "gh_merge_conflict")
         return MERGE_CONFLICT;
     if (reason && (reason.startsWith("ci_poll_") || RETRYABLE_MERGE_REASONS.has(reason))) {
@@ -217,8 +247,10 @@ export function classifyMergeFailureErrorKind(response) {
  *
  * BAPI-1021: a {@link MERGE_REF_MISMATCH} classifies as `classification:
  * "clean_exit"` rather than `"crashed"` — it is a deliberate refusal the
- * executor made correctly, not a crash. Every other merge outcome keeps its
- * existing `"crashed"` classification.
+ * executor made correctly, not a crash. BAPI-1234 adds the two migration-graph
+ * refusal kinds to that set: a `crashed` classification would make the
+ * backend's merge re-fire lane retry a merge the server will refuse identically.
+ * Every other merge outcome keeps its existing `"crashed"` classification.
  */
 export function buildMergeJobFailure(response) {
     const reason = asString(response.reason ?? undefined) ?? response.status;
@@ -226,7 +258,7 @@ export function buildMergeJobFailure(response) {
     return {
         error_kind: errorKind,
         error_message: secretFreeErrorMessage(new Error(`local merge ${response.status}: ${reason}`)),
-        classification: errorKind === MERGE_REF_MISMATCH ? "clean_exit" : "crashed",
+        classification: DELIBERATE_REFUSAL_ERROR_KINDS.has(errorKind) ? "clean_exit" : "crashed",
     };
 }
 /**
@@ -321,5 +353,14 @@ export async function runExecutorMergeJob(job, seams) {
  * unchanged (no App token is ever placed here).
  */
 export function buildDefaultMergeLocalDeps(deps, signal) {
-    return { env: deps.env, signal };
+    // BAPI-1136: the executor's merge job runs on the operator's own machine, which
+    // is typed `local`, so it reads the local configuration key and no other. The
+    // environment is still passed for the allowlisted operational base (PATH, HOME,
+    // certificates); it no longer supplies the identity, and an ambient GH_TOKEN in
+    // it is dropped rather than inherited.
+    return {
+        env: deps.env,
+        credential: resolveLocalMergeCredential(deps.env, "local"),
+        signal,
+    };
 }

package/build/executor/observation.js

@@ -291,7 +291,7 @@ function parseRateLimitEvent(obj) {
 const RATE_LIMIT_CONSEQUENCE_TEXT = "The executor keeps claiming: a worker that hits the ceiling fails fast and its " +
     "job classifies as a worker failure under the normal retry budget.";
 /** Fixed runbook reference appended to every rate-limit diagnostic (BAPI-898). */
-const RATE_LIMIT_RUNBOOK_REFERENCE = "See docs/claude/epic-conductor-v2-operator-runbook.md §8.";
+const RATE_LIMIT_RUNBOOK_REFERENCE = "See docs/claude/epic-implementer-v2-operator-runbook.md §8.";
 /**
  * Render the operator-facing rate-limit line (BAPI-828, BAPI-898).
  *

package/build/executor/preflight.js

@@ -11,7 +11,7 @@ import { resolveAllExecutorApiAccess, resolveBaseUrl, EXECUTOR_BASE_URL_REQUIRED
  * time out, and letting a job influence the executor's own safety-probe budget
  * would be a privilege inversion.
  */
-export const DENY_PROBE_TIMEOUT_ENV_KEY = "BAPI_CONDUCTOR_DENY_PROBE_TIMEOUT_MS";
+export const DENY_PROBE_TIMEOUT_ENV_KEY = "BAPI_EPIC_IMPLEMENTER_DENY_PROBE_TIMEOUT_MS";
 /**
  * Accepted bounds for the resolved probe timeout. The lower bound keeps a
  * fat-fingered `1` from turning every probe into an instant HANG (which is FATAL —

package/build/executor/prompt-spec.js

@@ -2,7 +2,7 @@
  * Executor-side structured prompt-spec renderer (BAPI-550, TDD §6/§7).
  *
  * The reconciler ships a server-authored prompt template in a `spec_review` job's
- * `payload.prompt_spec` (from `src/python/llms/agents/conductor_jobs/prompt_specs.py`).
+ * `payload.prompt_spec` (from `src/python/llms/agents/epic_implementer_jobs/prompt_specs.py`).
  * This module validates that spec and renders it into the single `claude -p`
  * prompt string, substituting each declared `{{PLACEHOLDER}}` marker from real
  * runtime state (ticket spec, base/work branch, git log, prior revise reasons).