@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/review-tickets.js

@@ -12,8 +12,8 @@
  *
  * Optionally supports a supervisor-driven epic-dispatch path: when an
  * `EpicDispatchIdentity` is threaded through `ReviewTicketsOptions.epic`, each
- * spawned tab receives an epic-identity env block (BAPI_CONDUCTOR_EPIC_KEY /
- * BAPI_CONDUCTOR_EPIC_RUN_ID / BAPI_CONDUCTOR_PLAN_VERSION / BAPI_CONDUCTOR_RUN_ID)
+ * spawned tab receives an epic-identity env block (BAPI_EPIC_IMPLEMENTER_EPIC_KEY /
+ * BAPI_EPIC_IMPLEMENTER_EPIC_RUN_ID / BAPI_EPIC_IMPLEMENTER_PLAN_VERSION / BAPI_EPIC_IMPLEMENTER_RUN_ID)
  * and dispatch is made idempotent via an injected `claimEpicDispatch` callback.
  * This path is worktree-free and base-branch-free; the human CLI path leaves
  * `epic` unset and retains byte-for-byte identical behavior.
@@ -518,7 +518,7 @@ export function buildReviewPlanRows(deps, options, agent, status, overrides = {}
         if (options.epic) {
             const mint = overrides.mintRunId ?? mintStartTicketsRunId;
             runId = mint([key]);
-            const env = { ...buildEpicIdentityEnv(options.epic), BAPI_CONDUCTOR_RUN_ID: runId };
+            const env = { ...buildEpicIdentityEnv(options.epic), BAPI_EPIC_IMPLEMENTER_RUN_ID: runId };
             command = injectConductorEnvIntoShellCommand(deps.platform, baseCommand, env);
         }
         return {
@@ -599,7 +599,7 @@ export async function orchestrateReviewTickets(deps, options, overrides = {}) {
         if (options.epic) {
             const mint = overrides.mintRunId ?? mintStartTicketsRunId;
             runId = mint([key]);
-            const env = { ...buildEpicIdentityEnv(options.epic), BAPI_CONDUCTOR_RUN_ID: runId };
+            const env = { ...buildEpicIdentityEnv(options.epic), BAPI_EPIC_IMPLEMENTER_RUN_ID: runId };
             shellCommand = injectConductorEnvIntoShellCommand(deps.platform, baseShellCommand, env);
             if (options.epic.dispatch_key) {
                 if (!overrides.claimEpicDispatch) {

package/build/run-unit-tests-launcher.js

@@ -65,6 +65,11 @@ export const MODULE_MOCK_MANIFEST = [
     "build/conductor/store-lifecycle.test.js",
     "build/conductor/store-queries.test.js",
     "build/conductor/tools.test.js",
+    // BAPI-1247: drives offerBitbucketConnection to a chosen structured outcome by
+    // mocking the shared connect flow at install-bridge.ts's import site, which needs
+    // --experimental-test-module-mocks. Kept apart from install-bridge.test.js so that
+    // 346-test file stays in the NORMAL lane.
+    "build/connect-bitbucket-handoff.test.js",
     "build/connect-github-api.test.js",
     "build/connect-github-dispatch.static.test.js",
     "build/connect-github-handoff.test.js",

package/build/setup-epic.js

@@ -78,7 +78,14 @@
 import { readFile as fsReadFile, stat as fsStat } from "node:fs/promises";
 import os from "node:os";
 import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, } from "./epic-integration-pr.js";
-import { approveEpicPlan, createEpicRunWithDisposition, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
+import { approveEpicPlan, buildConductorJiraUrl, conductorGetHeaders, createEpicRunWithDisposition, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
+// BAPI-1133 (A2) — the single legacy-to-typed merge-execution-mode mapping and
+// its total legacy resolver live in `merge-pull-request.ts` (no import cycle:
+// that module never imports from `setup-epic.ts`). Reused here rather than
+// reimplemented so the mapping stays single-defined.
+import { mapLegacyMergeExecutionModeToPolicyMode, resolveMergeExecutionMode, } from "./merge-pull-request.js";
+import { MERGE_EXECUTION_INELIGIBLE, MERGE_EXECUTION_MODE_GITHUB_ACTIONS, MERGE_WORKFLOW_REMEDY_COMMAND, } from "./conductor/merge-execution-contract.js";
+import { classifyMergeExecutionEligibility } from "./conductor/merge-execution-eligibility.js";
 import { resolveTrackedPaths } from "./git-reachability.js";
 import { validateBranchName } from "./base-ref.js";
 // Reused from the implement-epic client on purpose: adding a second wrapper under
@@ -89,8 +96,8 @@ import { validateBranchName } from "./base-ref.js";
 // typed clients the pilot already has are the v2 path's clients too, so neither
 // conductor can drift on a field name or an endpoint shape. No MCP tool, no
 // input-schema field, and no description changes.
-import { getConfigFieldBaseBranch, getIndexScopeLifecycle, getParseStatus, } from "./implement-epic/bridge-client.js";
-import { boundScopeLifecycleLabel, createExecFileRunCommand, ensureCommitResolvableLocally, normalizeCommitSha, performExactIndexScopeCut, pollIndexScopeLifecycle, readRemoteBranchHead, runGit, SCOPE_BOOTSTRAP_POLL_INTERVAL_MS, SCOPE_LIFECYCLE_LABELS, } from "./implement-epic/cut-protocol.js";
+import { getConfigFieldBaseBranch, getIndexScopeLifecycle, getParseStatus, } from "./epic-shared/bridge-client.js";
+import { boundScopeLifecycleLabel, createExecFileRunCommand, ensureCommitResolvableLocally, normalizeCommitSha, performExactIndexScopeCut, pollIndexScopeLifecycle, readRemoteBranchHead, runGit, SCOPE_BOOTSTRAP_POLL_INTERVAL_MS, SCOPE_LIFECYCLE_LABELS, } from "./epic-shared/cut-protocol.js";
 import { hashPlan } from "./conductor/plan.js";
 import { BRING_UP_REFUSAL_MESSAGES, firstBringUpRefusal, } from "./conductor/bring-up-facts.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
@@ -111,7 +118,7 @@ export const SETUP_EPIC_UNATTENDED_POSTURE = "unattended";
 /**
  * The server's stable error code for an unattended-posture refusal (BAPI-734).
  *
- * Mirrors `api.library.epic_conductor.unattended_posture.UNATTENDED_POSTURE_REFUSED_CODE`.
+ * Mirrors `api.library.epic_implementer.unattended_posture.UNATTENDED_POSTURE_REFUSED_CODE`.
  * Matched by EQUALITY on the structured `error_code`, never by searching the
  * message text: the message is prose that may be rewritten, the code is the
  * contract.
@@ -128,6 +135,19 @@ export const SETUP_EPIC_UNATTENDED_POSTURE_REFUSED_CODE = "UNATTENDED_POSTURE_RE
  * which is what the observed BAPI-1085 run did.
  */
 export const SETUP_EPIC_AUTO_MERGE_POLICY_KEY = "v2_auto_merge_enabled";
+/**
+ * The `policy_json` key declaring the typed merge-execution mode (BAPI-1133, A2).
+ *
+ * Composed into the unattended default alongside `posture` and
+ * {@link SETUP_EPIC_AUTO_MERGE_POLICY_KEY}, in the SAME fill-if-absent branch,
+ * because the server's `RunPolicy` refuses an unattended auto-merge policy that
+ * omits it (`merge_execution_mode_unconfigured`). `setup-epic` is the only
+ * IMPLICIT writer of this key — any other client may still submit it explicitly
+ * as operator policy, and an explicitly supplied value here is never overwritten.
+ * Declaring `github_actions` or `machine_token` is intent only in this slice:
+ * neither changes merge execution until a later A2 child.
+ */
+export const SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY = "merge_execution_mode";
 /** Accepted `policy_json.review_policy.source` values (the `ReviewPolicy` surface). */
 export const SETUP_EPIC_REVIEW_POLICY_SOURCES = [
     "verdict_protocol",
@@ -169,12 +189,15 @@ export function getSetupEpicUsage() {
         "repository base branch, matching plain start-tickets semantics.",
         "",
         "Posture (default): a run that selects an epic branch is created UNATTENDED —",
-        "posture: unattended and v2_auto_merge_enabled: true — and the server stamps its",
-        "CI gate at first approval from the repository default, or records an explicit",
-        "no-CI-gate mode when the repository declares none. Child PRs merge into the epic",
-        "branch; the INTEGRATION PR into the repository base branch stays human-gated.",
-        "Pass --attended to opt out. A run that selects no epic branch (--into-base, or a",
-        "single-node plan) is unchanged and composes no posture at all.",
+        "posture: unattended, v2_auto_merge_enabled: true, and merge_execution_mode",
+        "(declared automatically from the repository's configured merge execution; a",
+        "policy declaration only — it does not change merge execution in this release)",
+        "— and the server stamps its CI gate at first approval from the repository",
+        "default, or records an explicit no-CI-gate mode when the repository declares",
+        "none. Child PRs merge into the epic branch; the INTEGRATION PR into the",
+        "repository base branch stays human-gated. Pass --attended to opt out. A run",
+        "that selects no epic branch (--into-base, or a single-node plan) is unchanged",
+        "and composes no posture at all.",
         "",
         "Unattended runs have TWO one-time repository prerequisites, refused by name",
         "before any run is created: repository consent (unattended_epic_implementer_allowed) and",
@@ -239,7 +262,7 @@ export function getSetupEpicUsage() {
         "                         10799; remediate / ci_fix 3599; rebase / smoke 2699;",
         "                         merge 1799); the server rejects a higher value with a",
         "                         422 naming the offending field. Full table:",
-        "                         docs/claude/epic-conductor-v2-operator-runbook.md §4.",
+        "                         docs/claude/epic-implementer-v2-operator-runbook.md §4.",
         "  --replace-policy       Authorize replacing a LIVE run's stored policy with the",
         "                         policy file, as a complete replacement. Without it, a",
         "                         divergent policy on a reused run is refused with a",
@@ -1130,7 +1153,7 @@ export function resolveFeatureBranchSelection(opts, planNodeCount, policyDeclare
  * refused every unattended run, its own named remedy included.
  *
  * The reason CODES are the server's bounded vocabulary, spelled exactly as
- * `api/library/epic_conductor/unattended_posture.py` spells them. The client adds
+ * `api/library/epic_implementer/unattended_posture.py` spells them. The client adds
  * remediation TEXT around them and invents no aliases — an alias would drift from
  * the server's refusal the first time either side was edited, and an operator
  * comparing a CLI message with an API response would have no way to tell they
@@ -1145,7 +1168,7 @@ export function resolveFeatureBranchSelection(opts, planNodeCount, policyDeclare
  * Does this policy declare a notify webhook the server would probe?
  *
  * BAPI-1102. The shape check mirrors `_extract_webhook_url` in
- * `api/library/epic_conductor/webhook_verification.py` exactly as far as
+ * `api/library/epic_implementer/webhook_verification.py` exactly as far as
  * PRESENCE goes — a `notify` object carrying a non-blank string `webhook_url` —
  * and stops there on purpose. Scheme, host, and reachability are the server's to
  * judge at activation, where the probe actually happens; re-deciding them here
@@ -1244,6 +1267,66 @@ export function evaluateSetupEpicBringUpPrerequisites(readiness) {
         return null;
     return { reason, message: `${BRING_UP_REFUSAL_MESSAGES[reason]} ${NO_RUN_WAS_CREATED}` };
 }
+/**
+ * Read the composed policy's typed `merge_execution_mode`, if it declares one.
+ *
+ * Strict equality against the mirrored constant, matching the server's own guard
+ * (`preflight._strict_github_actions_mode`). A missing key, a non-string, and
+ * any other mode all answer `false`, so nothing but an explicit declaration
+ * opens the gate.
+ */
+export function policyDeclaresGitHubActionsMerge(policy) {
+    if (policy === undefined || policy === null)
+        return false;
+    return policy.merge_execution_mode === MERGE_EXECUTION_MODE_GITHUB_ACTIONS;
+}
+/**
+ * Evaluate merge-execution eligibility against a readiness report.
+ *
+ * Pure and total. Returns `null` — no refusal — for every policy that does not
+ * declare `github_actions` mode, without reading the report at all.
+ *
+ * Uses {@link classifyMergeExecutionEligibility}, the same classifier readiness
+ * and `drive-epic` read, so all three agree on the status AND on the first
+ * blocker. A client that classified the block itself here would eventually
+ * disagree with the row an operator had just been shown.
+ *
+ * BOTH `not_eligible` and `could_not_verify` return
+ * `merge_execution_ineligible`. One code, because the operator's next action is
+ * the same and splitting it would put the burden of telling "not proven" from
+ * "proven absent" on the person least able to check. The MESSAGE keeps the
+ * capability category explicit, so the distinction survives where it is
+ * actionable.
+ *
+ * The message is built from the shared remedy constant, ends with the exact
+ * standalone sentence `No run was created.`, and carries no GitHub payload, URL,
+ * branch name, workflow source, credential, or exception text.
+ */
+export function evaluateSetupEpicMergeExecutionPrerequisites(readiness, requestedPolicy) {
+    if (!policyDeclaresGitHubActionsMerge(requestedPolicy))
+        return null;
+    if (readiness === null) {
+        return {
+            reason: MERGE_EXECUTION_INELIGIBLE,
+            message: "this run declares merge_execution_mode: github_actions, and the Bridge API " +
+                "conductor readiness report could not be read, so the repository's merge " +
+                "capability could not be confirmed. Retry once the server is reachable, or " +
+                `resolve it with \`${MERGE_WORKFLOW_REMEDY_COMMAND}\`. ${NO_RUN_WAS_CREATED}`,
+        };
+    }
+    const verdict = classifyMergeExecutionEligibility(readiness);
+    if (verdict.status === "eligible")
+        return null;
+    const category = verdict.status === "could_not_verify"
+        ? "could not be confirmed"
+        : "is not sufficient";
+    return {
+        reason: MERGE_EXECUTION_INELIGIBLE,
+        message: "this run declares merge_execution_mode: github_actions, and this repository's " +
+            `merge capability ${category}: ${verdict.detail}. Resolve it with ` +
+            `\`${MERGE_WORKFLOW_REMEDY_COMMAND}\`, then re-run. ${NO_RUN_WAS_CREATED}`,
+    };
+}
 /**
  * Does the policy this invocation will actually send request unattended operation?
  *
@@ -1283,8 +1366,10 @@ export function requestedPolicyIsUnattended(policy, attended) {
  * * **Feature branch, `--attended`** → `base_branch` plus an explicitly
  *   requested `review_policy`, and nothing else. Byte-identical to the
  *   pre-BAPI-1102 composition, which is precisely what the opt-out promises.
- * * **Feature branch, default** → adds `posture: "unattended"` and
- *   `v2_auto_merge_enabled: true`.
+ * * **Feature branch, default** → adds `posture: "unattended"`,
+ *   `v2_auto_merge_enabled: true`, and (BAPI-1133, A2) `merge_execution_mode`
+ *   when the caller resolved one — the server refuses an unattended auto-merge
+ *   policy that omits it.
  *
  * Deliberately absent from every shape:
  *
@@ -1306,6 +1391,9 @@ export function composeDefaultSetupEpicPolicy(args) {
         if (!args.attended) {
             policy.posture = SETUP_EPIC_UNATTENDED_POSTURE;
             policy[SETUP_EPIC_AUTO_MERGE_POLICY_KEY] = true;
+            if (args.mergeExecutionMode !== undefined) {
+                policy[SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY] = args.mergeExecutionMode;
+            }
         }
     }
     if (args.reviewPolicy !== undefined) {
@@ -1346,6 +1434,14 @@ export function composeDefaultSetupEpicPolicy(args) {
  * * **`v2_auto_merge_enabled` already present** → left exactly as the file set
  *   it, including `false`. Filling the posture does not overwrite an explicit
  *   merge decision.
+ * * **`merge_execution_mode` already present** (BAPI-1133, A2) → left exactly
+ *   as the file set it, valid or not. An explicitly present but invalid mode is
+ *   NOT silently repaired here; it is forwarded unchanged so the server's
+ *   secret-safe typed validation rejects it. Absent, it is filled from the
+ *   caller's already-resolved {@link TypedMergeExecutionMode} in the same
+ *   fill-if-absent branch that stamps `posture` and
+ *   {@link SETUP_EPIC_AUTO_MERGE_POLICY_KEY} — the server refuses an
+ *   unattended auto-merge policy that omits it.
  *
  * Pure: it returns a new object and never mutates the input. It is applied on the
  * CREATE path only. A reused live run reconciles the file against its STORED
@@ -1365,6 +1461,10 @@ export function applySetupEpicUnattendedDefault(policy, args) {
     if (!(SETUP_EPIC_AUTO_MERGE_POLICY_KEY in composed)) {
         composed[SETUP_EPIC_AUTO_MERGE_POLICY_KEY] = true;
     }
+    if (!(SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY in composed) &&
+        args.mergeExecutionMode !== undefined) {
+        composed[SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY] = args.mergeExecutionMode;
+    }
     return composed;
 }
 /**
@@ -1492,7 +1592,7 @@ export const SETUP_EPIC_SCOPE_RECOVERY_COMMAND = "re-run this same setup-epic co
  * The canonical one-line recovery for a scope collision (BAPI-1009).
  *
  * Repeated VERBATIM as the epic-run gate snapshot's shadow-hold recovery hint
- * (``api/library/epic_conductor/gate_snapshot_service.py``), so an operator who
+ * (``api/library/epic_implementer/gate_snapshot_service.py``), so an operator who
  * reads the diagnosis on the status surface and an operator who reads it from
  * the CLI are told to do the same thing in the same words.
  */
@@ -1873,6 +1973,27 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
     // `base_branch` is honored exactly as `--feature-branch` would be. A malformed
     // or unknown policy field is left for the server's strict validation.
     const effectiveFeatureBranch = resolveEffectiveFeatureBranch(featureBranch, requestedPolicy);
+    // --- Typed merge-execution-mode declaration (BAPI-1133, A2) ---------------
+    // Resolved ONCE, here, before either composer runs, so the composer functions
+    // stay pure and synchronous. Gated on the exact predicate both composers'
+    // OWN fill-if-absent branches use — `!attended`, a feature branch selected,
+    // and (for the file path) no `posture` already declared — so this never
+    // performs the new configuration read for `--attended` or `--into-base` runs,
+    // and never for a file that already answered the posture question itself.
+    const unattendedDefaultEligible = !opts.attended &&
+        effectiveFeatureBranch !== undefined &&
+        (requestedPolicy === undefined || !("posture" in requestedPolicy));
+    let declaredMergeExecutionMode;
+    if (unattendedDefaultEligible) {
+        const mergeExecutionModeResolverDeps = {
+            repoName: access.repoName,
+            buildGetUrl: (path, params) => buildConductorJiraUrl(access.baseUrl, path, params),
+            getHeaders: async () => conductorGetHeaders(access),
+            fetchImpl: deps.fetch,
+        };
+        const effectiveLegacyMode = await resolveMergeExecutionMode(mergeExecutionModeResolverDeps);
+        declaredMergeExecutionMode = mapLegacyMergeExecutionModeToPolicyMode(effectiveLegacyMode);
+    }
     // --- The policy the CREATE path will send (BAPI-1102) ---------------------
     // Composed HERE, as soon as both of its inputs exist, so the one object that
     // gets reported, gated, and sent is the same object throughout. It is consumed
@@ -1883,12 +2004,30 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         ? applySetupEpicUnattendedDefault(requestedPolicy, {
             featureBranch: effectiveFeatureBranch,
             attended: opts.attended,
+            mergeExecutionMode: declaredMergeExecutionMode,
         })
         : composeDefaultSetupEpicPolicy({
             featureBranch,
             attended: opts.attended,
             reviewPolicy: opts.reviewPolicy,
+            mergeExecutionMode: declaredMergeExecutionMode,
         });
+    // BAPI-1133 (A2). Reported only when THIS command stamped the key — i.e. it
+    // is present in the composed policy and was absent from whatever the
+    // operator supplied — as low-emphasis policy metadata, mirroring the
+    // existing posture/auto-merge reporting rather than adding a new prompt,
+    // wizard, or runtime status. An explicitly declared mode (CLI-composed
+    // policy already carrying the key) is never reported here as if it were
+    // this command's decision.
+    const mergeExecutionModeStamped = declaredMergeExecutionMode !== undefined &&
+        composedForCreate[SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY] === declaredMergeExecutionMode &&
+        (requestedPolicy === undefined ||
+            !(SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY in requestedPolicy));
+    if (mergeExecutionModeStamped) {
+        say(`Policy:     merge_execution_mode: ${declaredMergeExecutionMode} (declared automatically ` +
+            `for the unattended default; policy metadata only — no dispatch, actuation, eligibility, ` +
+            `containment, or escalation behavior until a later A2 child)`);
+    }
     if (requestedPolicy !== undefined) {
         // The posture is stated for the FILE path too, and read off the composed
         // object rather than re-derived. The `--policy-file` invocation is the one
@@ -2256,7 +2395,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 : `  - feature branch: ${effectiveFeatureBranch} (validated server-side at approval; no request made in dry-run)`);
             if (needsCut && cutCommitSha !== null && scopeBaseBranch !== null) {
                 say(`  - would open a draft pull request ${effectiveFeatureBranch} → ${scopeBaseBranch} ` +
-                    "for conductor-ci / gate (BAPI-951; nothing opened in dry-run)");
+                    "for epic-implementer-ci / gate (BAPI-951; nothing opened in dry-run)");
             }
         }
         if (opts.reviewPolicy !== undefined) {
@@ -2430,6 +2569,21 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 deps.errorLog(`setup-epic REFUSED (${bringUpRefusal.reason}): ${bringUpRefusal.message}`);
                 return 1;
             }
+            // BAPI-1135 — merge-execution eligibility, AFTER the universal bring-up
+            // blockers (an unreadable readiness report and a behind database make this
+            // question moot) and BEFORE the unattended prerequisites and every
+            // approval check below. That position is what keeps readiness, this gate,
+            // and the approval refusal naming the SAME first blocker.
+            //
+            // Outside the `requestedPolicyIsUnattended` branch on purpose: an
+            // `--attended` run that declares `github_actions` mode is gated too. The
+            // evaluator itself returns null for every policy that does not declare the
+            // mode, so no other run's behavior changes.
+            const mergeExecutionRefusal = evaluateSetupEpicMergeExecutionPrerequisites(readiness, composedForCreate);
+            if (mergeExecutionRefusal !== null) {
+                deps.errorLog(`setup-epic REFUSED (${mergeExecutionRefusal.reason}): ${mergeExecutionRefusal.message}`);
+                return 1;
+            }
             if (requestedPolicyIsUnattended(composedForCreate, opts.attended)) {
                 // The COMPOSED policy, not the flags: a --policy-file declaring
                 // notify.webhook_url satisfies the escalation-channel prerequisite, and

package/build/start-tickets-conductor.js

@@ -62,20 +62,20 @@ export function mintStartTicketsWorkerId(ticketKey, agentName, fragment = random
  */
 export function buildEpicIdentityEnv(epic) {
     const env = {
-        BAPI_CONDUCTOR_EPIC_KEY: epic.epic_key,
-        BAPI_CONDUCTOR_EPIC_RUN_ID: epic.epic_run_id,
-        BAPI_CONDUCTOR_PLAN_VERSION: String(epic.plan_version),
+        BAPI_EPIC_IMPLEMENTER_EPIC_KEY: epic.epic_key,
+        BAPI_EPIC_IMPLEMENTER_EPIC_RUN_ID: epic.epic_run_id,
+        BAPI_EPIC_IMPLEMENTER_PLAN_VERSION: String(epic.plan_version),
     };
     const declared = normalizeDeclaredTouchedFiles(epic.declared_touched_files);
     if (declared.length > 0) {
-        env.BAPI_CONDUCTOR_DECLARED_TOUCHED_FILES_JSON = JSON.stringify(declared);
+        env.BAPI_EPIC_IMPLEMENTER_DECLARED_TOUCHED_FILES_JSON = JSON.stringify(declared);
     }
     return env;
 }
 // ---------------------------------------------------------------------------
 // Conductor context
 // ---------------------------------------------------------------------------
-/** Default gate name when no `BAPI_CONDUCTOR_GATE_NAME` override is present. */
+/** Default gate name when no `BAPI_EPIC_IMPLEMENTER_GATE_NAME` override is present. */
 export const DEFAULT_CONDUCTOR_GATE_NAME = "implement-ticket";
 /**
  * Resolve a packaged build artifact path relative to this compiled module.
@@ -110,11 +110,11 @@ export async function createStartTicketsConductorContext(options, agent, deps) {
         // Repo resolution must never abort conductor setup; fall back to null.
         repoName = null;
     }
-    const gateName = nonEmpty(deps.env.BAPI_CONDUCTOR_GATE_NAME)
-        ? deps.env.BAPI_CONDUCTOR_GATE_NAME.trim()
+    const gateName = nonEmpty(deps.env.BAPI_EPIC_IMPLEMENTER_GATE_NAME)
+        ? deps.env.BAPI_EPIC_IMPLEMENTER_GATE_NAME.trim()
         : DEFAULT_CONDUCTOR_GATE_NAME;
-    const supervisorMode = nonEmpty(deps.env.BAPI_CONDUCTOR_SUPERVISOR_MODE)
-        ? deps.env.BAPI_CONDUCTOR_SUPERVISOR_MODE.trim()
+    const supervisorMode = nonEmpty(deps.env.BAPI_EPIC_IMPLEMENTER_SUPERVISOR_MODE)
+        ? deps.env.BAPI_EPIC_IMPLEMENTER_SUPERVISOR_MODE.trim()
         : options.autoApprove
             ? "auto"
             : "interactive";
@@ -142,12 +142,12 @@ export async function createStartTicketsConductorContext(options, agent, deps) {
 // ---------------------------------------------------------------------------
 /** Conductor store-tuning env keys forwarded only when already set upstream. */
 const CONDUCTOR_TUNING_ENV_KEYS = [
-    "BAPI_CONDUCTOR_BUSY_TIMEOUT_MS",
-    "BAPI_CONDUCTOR_RETENTION_DAYS",
-    "BAPI_CONDUCTOR_RETENTION_MAX_ROWS",
+    "BAPI_EPIC_IMPLEMENTER_BUSY_TIMEOUT_MS",
+    "BAPI_EPIC_IMPLEMENTER_RETENTION_DAYS",
+    "BAPI_EPIC_IMPLEMENTER_RETENTION_MAX_ROWS",
     // BAPI-397: per-type relay cooldown — forwarded only when explicitly set so
     // the supervisor's send config is honoured by the conductor store it writes to.
-    "BAPI_CONDUCTOR_MESSAGE_COOLDOWN_MS",
+    "BAPI_EPIC_IMPLEMENTER_MESSAGE_COOLDOWN_MS",
 ];
 /** Truthy predicate for opt-in conductor boolean flags (`1` / `true`). */
 export function isConductorFlagEnabled(value) {
@@ -164,30 +164,30 @@ export function isConductorFlagEnabled(value) {
  * upstream.
  */
 export function buildConductorWorkerEnv(context, worker, parentEnv) {
-    // Merge "conductor" into the parent project's profile rather than overwriting it.
+    // Merge "epic_implementer" into the parent project's profile rather than overwriting it.
     // This preserves groups like "sfcc" that the project already has, while adding
     // the conductor-specific tools. Only validated group tokens from resolveProfiles
     // are threaded — arbitrary parentEnv keys never leak through.
     const parentActiveGroups = new Set(resolveProfiles(parentEnv.BRIDGE_MCP_PROFILE));
-    parentActiveGroups.add("conductor");
+    parentActiveGroups.add("epic_implementer");
     const mergedProfile = Array.from(parentActiveGroups).join(",");
     const env = {
-        BAPI_CONDUCTOR_ENABLED: "1",
+        BAPI_EPIC_IMPLEMENTER_ENABLED: "1",
         BRIDGE_MCP_PROFILE: mergedProfile,
-        BAPI_CONDUCTOR_RUN_ID: context.runId,
-        BAPI_CONDUCTOR_WORKER_ID: worker.workerId,
-        BAPI_CONDUCTOR_TICKET_KEY: worker.ticketKey,
-        BAPI_CONDUCTOR_WORKTREE_PATH: worker.worktreePath,
-        BAPI_CONDUCTOR_GATE_NAME: context.gateName,
-        BAPI_CONDUCTOR_SUPERVISOR_MODE: context.supervisorMode,
-        BAPI_CONDUCTOR_CLI_FILE: context.cliFile,
+        BAPI_EPIC_IMPLEMENTER_RUN_ID: context.runId,
+        BAPI_EPIC_IMPLEMENTER_WORKER_ID: worker.workerId,
+        BAPI_EPIC_IMPLEMENTER_TICKET_KEY: worker.ticketKey,
+        BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH: worker.worktreePath,
+        BAPI_EPIC_IMPLEMENTER_GATE_NAME: context.gateName,
+        BAPI_EPIC_IMPLEMENTER_SUPERVISOR_MODE: context.supervisorMode,
+        BAPI_EPIC_IMPLEMENTER_CLI_FILE: context.cliFile,
         // BAPI-527: the CLI file + Node runtime are a PAIR. The worker runs
         // conductor-bin.js under this captured conductor Node for every worker-side
         // ledger op, so the worker Node never loads better-sqlite3. Non-secret.
-        CONDUCTOR_NODE_PATH: context.conductorNodePath,
+        EPIC_IMPLEMENTER_NODE_PATH: context.conductorNodePath,
     };
     if (context.repoName) {
-        env.BAPI_CONDUCTOR_REPO_NAME = context.repoName;
+        env.BAPI_EPIC_IMPLEMENTER_REPO_NAME = context.repoName;
     }
     if (context.epic) {
         const epicEnv = buildEpicIdentityEnv(context.epic);
@@ -195,8 +195,8 @@ export function buildConductorWorkerEnv(context, worker, parentEnv) {
             env[k] = v;
         }
     }
-    if (isConductorFlagEnabled(parentEnv.BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE)) {
-        env.BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE = "1";
+    if (isConductorFlagEnabled(parentEnv.BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE)) {
+        env.BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE = "1";
     }
     for (const key of CONDUCTOR_TUNING_ENV_KEYS) {
         if (nonEmpty(parentEnv[key])) {
@@ -234,13 +234,13 @@ function shellQuotePath(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }
 /**
- * Resolve the hook command string. Prefers `BAPI_CONDUCTOR_HOOK_COMMAND`
+ * Resolve the hook command string. Prefers `BAPI_EPIC_IMPLEMENTER_HOOK_COMMAND`
  * verbatim; otherwise runs the packaged hook bin via the current Node
  * executable.
  */
 export function resolveConductorHookCommand(env, hookBinPath, execPath = process.execPath) {
-    if (nonEmpty(env.BAPI_CONDUCTOR_HOOK_COMMAND)) {
-        return env.BAPI_CONDUCTOR_HOOK_COMMAND;
+    if (nonEmpty(env.BAPI_EPIC_IMPLEMENTER_HOOK_COMMAND)) {
+        return env.BAPI_EPIC_IMPLEMENTER_HOOK_COMMAND;
     }
     return `${shellQuotePath(execPath)} ${shellQuotePath(hookBinPath)}`;
 }
@@ -279,7 +279,7 @@ export async function provisionConductorHookForWorktree(worktreePath, command, o
  */
 export async function provisionConductorHooksForRows(rows, context, deps) {
     const isClaude = context.agentName === "claude";
-    const enablePreToolUse = isConductorFlagEnabled(deps.env.BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE);
+    const enablePreToolUse = isConductorFlagEnabled(deps.env.BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE);
     const command = resolveConductorHookCommand(deps.env, context.hookBinPath, deps.execPath);
     const fragment = deps.workerFragment;
     const out = [];
@@ -451,7 +451,7 @@ export function buildSupervisorTabCommand(context, platform, nodeExecPath = proc
 /**
  * Decide whether the supervisor peer tab should launch. Enabled by default for a
  * normal packaged conductor context; disabled only when the resolved supervisor
- * mode is `off` (i.e. `BAPI_CONDUCTOR_SUPERVISOR_MODE=off`).
+ * mode is `off` (i.e. `BAPI_EPIC_IMPLEMENTER_SUPERVISOR_MODE=off`).
  */
 export function isSupervisorLaunchEnabled(context) {
     return context.supervisorMode.trim().toLowerCase() !== "off";

package/build/start-tickets-prereqs.js

@@ -52,7 +52,7 @@ export const START_TICKETS_DOCTOR_COMMAND = `npx -y ${MCP_PACKAGE_NAME} doctor`;
 /**
  * BAPI-527 live-source checkout guard (conductor durable execution).
  *
- * `BAPI_CONDUCTOR_LIVE_SOURCE_PATH` — OPTIONAL operator-set path to the checkout
+ * `BAPI_EPIC_IMPLEMENTER_LIVE_SOURCE_PATH` — OPTIONAL operator-set path to the checkout
  * an operator's live dev server (e.g. `uvicorn main:app --reload`) is running
  * from. When set, unattended conductor/epic/non-mutating start-tickets dispatch
  * refuses to run if the conductor base repo it would operate on resolves to the
@@ -62,14 +62,14 @@ export const START_TICKETS_DOCTOR_COMMAND = `npx -y ${MCP_PACKAGE_NAME} doctor`;
  * discovery, so this local env contract is introduced here. Read only from the
  * injected `deps.env` (never global `process.env`) so it stays mockable.
  *
- * `BAPI_CONDUCTOR_ALLOW_LIVE_SOURCE_DISPATCH` — explicit escape hatch. When set
+ * `BAPI_EPIC_IMPLEMENTER_ALLOW_LIVE_SOURCE_DISPATCH` — explicit escape hatch. When set
  * to a truthy value (`1`/`true`/`yes`/`on`, case-insensitive) a detected
  * collision is DOWNGRADED from fatal to a loud warning rather than silently
  * ignored, so an operator who genuinely wants same-checkout dispatch can opt in
  * with eyes open.
  */
-export const CONDUCTOR_LIVE_SOURCE_PATH_ENV = "BAPI_CONDUCTOR_LIVE_SOURCE_PATH";
-export const CONDUCTOR_ALLOW_LIVE_SOURCE_DISPATCH_ENV = "BAPI_CONDUCTOR_ALLOW_LIVE_SOURCE_DISPATCH";
+export const CONDUCTOR_LIVE_SOURCE_PATH_ENV = "BAPI_EPIC_IMPLEMENTER_LIVE_SOURCE_PATH";
+export const CONDUCTOR_ALLOW_LIVE_SOURCE_DISPATCH_ENV = "BAPI_EPIC_IMPLEMENTER_ALLOW_LIVE_SOURCE_DISPATCH";
 /** Stable descriptor id for the live-source checkout guard (used in messages + doctor). */
 export const LIVE_SOURCE_GUARD_ID = "conductor-live-source";
 /** True only for the three first-class supported platforms. */
@@ -566,11 +566,6 @@ const CLAUDE_MCP_SHADOWING_INSTALL_HINTS = {
  *   - a CONFIRMED foreign registration                      → `found: true` + advisory detail
  *   - unreadable / malformed config, or an unresolved main
  *     worktree path                                          → `found: true` + detail
- *
- * Reporting stays deliberately independent of the retired
- * `BAPI_CONDUCTOR_ALLOW_CLAUDE_MCP_SHADOWING` override: whether that variable is
- * exported has never had any bearing on whether the collision exists, and now it
- * has no bearing on anything at all.
  */
 export function claudeMcpShadowingDescriptor() {
     return {