@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/conductor/doctor.js

@@ -13,12 +13,13 @@ import os from "node:os";
 import { doctorConductorLedger } from "./store.js";
 import { detectClaudeLogin, formatClaudeLoginAdvisory } from "../claude-login.js";
 import { inspectConductorGitHooks } from "./git-hooks.js";
+import { MERGE_WORKFLOW_IDENTIFIER } from "./merge-execution-contract.js";
 import { resolveMcpShimInvocationForRuntime, resolvePackageRootFromModuleUrl, } from "../mcp-server-invocation.js";
 import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { resolveProfiles } from "../mcp-profile.js";
 import { createReadinessCheck, createReadinessCheckSafely, } from "../readiness-check.js";
 /**
- * Remediation for a conductor context whose resolved MCP groups omit `conductor`.
+ * Remediation for a conductor context whose resolved MCP groups omit `epic_implementer`.
  *
  * Fixed prose: it never interpolates the raw `BRIDGE_MCP_PROFILE` value. The
  * legacy warning does interpolate it (unchanged), but a consolidated report is a
@@ -26,7 +27,7 @@ import { createReadinessCheck, createReadinessCheckSafely, } from "../readiness-
  * gate needs to echo to name the fix. ADD, never replace — replacing the value
  * would drop the worker's other groups.
  */
-export const MCP_PROFILE_REMEDIATION = "ADD `conductor` to BRIDGE_MCP_PROFILE (comma-separated) — do NOT replace the existing value, " +
+export const MCP_PROFILE_REMEDIATION = "ADD `epic_implementer` to BRIDGE_MCP_PROFILE (comma-separated) — do NOT replace the existing value, " +
     "which would drop the worker's other tool groups. Without it the conductor/event/supervisor " +
     "tools are not registered.";
 /**
@@ -38,13 +39,24 @@ export const MCP_PROFILE_REMEDIATION = "ADD `conductor` to BRIDGE_MCP_PROFILE (c
  * is blocked on epic A2 (App elevation to `contents: write`); until A2 ships,
  * `gh` is a real prerequisite and this stays a named check.
  */
-export const GH_CLI_REMEDIATION = "install the GitHub CLI (`gh`) and put it on PATH; conductor-driven merges run under this " +
-    "host's own `gh` auth because the GitHub App token is `contents: read` and cannot merge.";
-/** Remediation for an installed but unauthenticated `gh` (AC-7; see {@link GH_CLI_REMEDIATION}). */
-export const GH_AUTH_REMEDIATION = "run `gh auth login` to grant the conductor merge permission; otherwise local merge emits " +
-    "merge.failed/skip rather than merging.";
-/** Detail used when `gh` authentication was never tested because `gh` is absent. */
-export const GH_AUTH_SKIPPED_DETAIL = "not tested — `gh` is not installed, so `gh auth status` was never run";
+export const GH_CLI_REMEDIATION = "install the GitHub CLI (`gh`) and put it on PATH; conductor-driven merges shell out to it " +
+    "because the GitHub App token is `contents: read` and cannot merge. Since BAPI-1136 `gh` " +
+    "authenticates with the configured merge credential, not with this host's own `gh` login.";
+/**
+ * Remediation for a host with no configured merge credential (BAPI-1136).
+ *
+ * This REPLACED a `gh auth login` remediation, and the replacement is the whole
+ * point. After the merge stopped authenticating as whoever is logged into `gh`,
+ * that instruction sent an operator to fix something the merge no longer reads —
+ * the most expensive kind of wrong hint, because following it looks reasonable
+ * and changes nothing. `merge-pull-request.ts` says exactly that about the same
+ * text; this is the last place it was still live.
+ */
+export const GH_AUTH_REMEDIATION = "set BAPI_LOCAL_MERGE_TOKEN (or BAPI_MACHINE_MERGE_TOKEN for machine-user mode) in the " +
+    "environment this host launches the conductor with; local merge has no ambient-login " +
+    "fallback and fails closed with a named reason when neither is configured.";
+/** Detail used when the credential check was not reached because `gh` is absent. */
+export const GH_AUTH_SKIPPED_DETAIL = "not tested — `gh` is not installed, so no merge could run regardless of credential";
 /**
  * Remediation for a native ledger whose binding does not load.
  *
@@ -70,9 +82,10 @@ export const MCP_PROFILE_UNSET = "(unset)";
 /**
  * The CLI-only verbs that call the Bridge API from a shell-spawned process and
  * therefore resolve credentials themselves (CLAUDE.md "Shell-Spawned Credential
- * Resolution"): the four BAPI-872 recovery verbs and the three BAPI-1154 repair
- * verbs. `.mcp.json` env is invisible to them — only `BAPI_API_KEY` in the parent
- * env and the user-scoped credential store count.
+ * Resolution"): the four BAPI-872 recovery verbs and the six run-addressed repair
+ * verbs (BAPI-1154's three and BAPI-1176's three). `.mcp.json` env is invisible to
+ * them — only `BAPI_API_KEY` in the parent env and the user-scoped credential
+ * store count.
  */
 export const CREDENTIALED_RECOVERY_COMMANDS = [
     "stop-run",
@@ -82,6 +95,9 @@ export const CREDENTIALED_RECOVERY_COMMANDS = [
     "scope-reparse",
     "dispatch-remediation",
     "merge-child",
+    "scope-catch-up",
+    "patch-policy",
+    "resume-run",
 ];
 /** Remediation for recovery/repair verbs that cannot resolve Bridge credentials. */
 export const REPAIR_CREDENTIAL_REMEDIATION = "export BAPI_API_KEY in the shell that runs `conductor`, or store a credential for this " +
@@ -364,13 +380,13 @@ export async function collectConductorNativeLedgerSafe(deps = {}) {
 }
 /**
  * Inspect the BRIDGE_MCP_PROFILE environment variable and warn when a
- * conductor/epic context is detected but the resolved groups omit `conductor`.
+ * conductor/epic context is detected but the resolved groups omit `epic_implementer`.
  * Strictly read-only, never throws.
  *
  * BAPI-772: health is judged from {@link resolveProfiles} — the SAME resolver the
  * MCP server registers tools with — instead of comparing the raw string to
- * `"conductor"`. The old equality check called a worker running
- * `BRIDGE_MCP_PROFILE=conductor,sfcc` (exactly what `buildConductorWorkerEnv`
+ * `"epic_implementer"`. The old equality check called a worker running
+ * `BRIDGE_MCP_PROFILE=epic_implementer,sfcc` (exactly what `buildConductorWorkerEnv`
  * produces on SFCC projects) or `full` degraded, and its remediation told the
  * operator to REPLACE the variable — which would have destroyed the worker's
  * other groups. The remediation now says ADD.
@@ -380,15 +396,15 @@ export function inspectMcpProfile(env) {
     const raw_profile = raw === undefined ? MCP_PROFILE_UNSET : raw;
     const groups = resolveProfiles(raw);
     const active_groups = Array.from(groups);
-    const conductor_context_detected = env.BAPI_CONDUCTOR_ENABLED === "1" || env.BAPI_CONDUCTOR_ENABLED === "true";
-    const degraded = conductor_context_detected && !groups.has("conductor");
+    const conductor_context_detected = env.BAPI_EPIC_IMPLEMENTER_ENABLED === "1" || env.BAPI_EPIC_IMPLEMENTER_ENABLED === "true";
+    const retired_profile = raw?.split(",").some((token) => token.trim().toLowerCase() === "conductor") ?? false;
+    const degraded = retired_profile || (conductor_context_detected && !groups.has("epic_implementer"));
     const warnings = [];
     if (degraded) {
-        warnings.push(`BRIDGE_MCP_PROFILE is ${raw_profile} (active groups: ${active_groups.join(", ")}) ` +
-            `but a conductor context is active. ADD \`conductor\` to BRIDGE_MCP_PROFILE ` +
-            `(e.g. \`${raw_profile === MCP_PROFILE_UNSET ? "conductor" : `${raw_profile},conductor`}\`) — ` +
-            `do NOT replace the value, which would drop the worker's other groups. ` +
-            `Without it the conductor/event/supervisor tools are not registered.`);
+        warnings.push(`Epic Implementer MCP profile is inactive (active groups: ${active_groups.join(", ")}). ` +
+            (retired_profile ? "The retired conductor profile token is ignored. " : "") +
+            "ADD `epic_implementer` to BRIDGE_MCP_PROFILE (comma-separated); keep other valid groups. " +
+            "Without it the Epic Implementer tools are not registered.");
     }
     // Fixed state labels and the CLOSED active-group vocabulary only (BAPI-1055):
     // `resolveProfiles` yields nothing but recognized group names, so this detail
@@ -397,14 +413,14 @@ export function inspectMcpProfile(env) {
         degraded
             ? {
                 id: "mcp-profile",
-                label: "MCP conductor profile",
+                label: "Epic Implementer MCP profile",
                 status: "warn",
-                detail: `a conductor context is active but the resolved groups omit \`conductor\` (active: ${active_groups.join(", ")})`,
+                detail: `the resolved groups omit \`epic_implementer\` (active: ${active_groups.join(", ")})`,
                 remediation: MCP_PROFILE_REMEDIATION,
             }
             : {
                 id: "mcp-profile",
-                label: "MCP conductor profile",
+                label: "Epic Implementer MCP profile",
                 status: "pass",
                 detail: conductor_context_detected
                     ? `conductor context active; resolved groups: ${active_groups.join(", ")}`
@@ -418,7 +434,7 @@ export function inspectMcpProfile(env) {
  * `gh auth status` (no writes, no merge) and reports whether the host could merge
  * a PR locally if `policy_json.local_merge.enabled` were set. Never throws.
  */
-export function inspectLocalMerge(runCommand) {
+export function inspectLocalMerge(runCommand, env = process.env) {
     const run = runCommand ??
         ((cmd, args) => {
             try {
@@ -443,48 +459,51 @@ export function inspectLocalMerge(runCommand) {
             }
         });
     let gh_available = false;
-    let gh_authed = false;
     try {
         gh_available = run("gh", ["--version"]).status === 0;
     }
     catch {
         gh_available = false;
     }
-    if (gh_available) {
-        try {
-            gh_authed = run("gh", ["auth", "status"]).status === 0;
-        }
-        catch {
-            gh_authed = false;
-        }
-    }
+    // BAPI-1136. This used to run `gh auth status` and call the result
+    // `gh_authed`. That probe measured the ambient session, which the merge stopped
+    // consulting — so it reported PASS on a host with a logged-in `gh` and no
+    // configured credential (every merge then failing
+    // `local_merge_credential_missing`), and WARN on a host with the credential set
+    // and no ambient login (where merges work). Both directions wrong.
+    //
+    // The replacement asks the question the merge actually asks, and answers it
+    // read-only from the environment — no subprocess, no network, and no credential
+    // VALUE anywhere in the result. Either mode's key satisfies it: which one a run
+    // uses is the server-resolved typed mode, which a local doctor cannot know.
+    const merge_credential_configured = ["BAPI_LOCAL_MERGE_TOKEN", "BAPI_MACHINE_MERGE_TOKEN"].some((key) => typeof env[key] === "string" && env[key].trim().length > 0);
     const warnings = [];
     if (!gh_available) {
         warnings.push("`gh` is not installed or not on PATH. Local merge (policy_json.local_merge.enabled) " +
             "cannot run; install the GitHub CLI to enable conductor-driven merges.");
     }
-    else if (!gh_authed) {
-        warnings.push("`gh` is installed but not authenticated (`gh auth status` failed). Run `gh auth login` " +
-            "to grant the conductor merge permission; otherwise local merge will emit merge.failed/skip.");
-    }
-    // Capability gap only — local merge is opt-in, so an unauthed host is not a hard
-    // failure unless the operator enabled it. Reported as degraded for visibility.
-    const degraded = !gh_available || !gh_authed;
-    // TWO outcomes, not one (BAPI-1055): installing `gh` and running `gh auth
-    // login` are independently actionable, and `degraded` below is deliberately
-    // left as the SAME `!gh_available || !gh_authed` conjunction it has always
-    // been. When `gh` is absent the auth outcome is `skip`, never `fail` — the
-    // authentication was never tested, and claiming it failed would send the
-    // operator to `gh auth login` on a host with no `gh`.
+    else if (!merge_credential_configured) {
+        warnings.push("`gh` is installed but no merge credential is configured. Set BAPI_LOCAL_MERGE_TOKEN " +
+            "(or BAPI_MACHINE_MERGE_TOKEN for machine-user mode); local merge has no ambient-login " +
+            "fallback and fails closed with a named reason.");
+    }
+    // Capability gap only — local merge is opt-in, so an unconfigured host is not a
+    // hard failure unless the operator enabled it. Reported as degraded for visibility.
+    const degraded = !gh_available || !merge_credential_configured;
+    // TWO outcomes, not one (BAPI-1055): installing `gh` and configuring the merge
+    // credential are independently actionable, and `degraded` stays the same
+    // `!gh_available || !<second check>` conjunction it has always been. When `gh`
+    // is absent the second outcome is `skip`, never `fail` — nothing could merge on
+    // that host regardless of credential, so reporting a credential failure would
+    // name the wrong fix.
     //
-    // AC-7 — these two checks are LOAD-BEARING and must not be retired here.
-    // Conductor merges run under this machine's own `gh` auth because the GitHub
-    // App token is `contents: read` and structurally cannot merge; see
-    // `mcp_server/src/executor/merge-job.ts` and the `contents: read` constraint
-    // documented in `mcp_server/src/merge-pull-request.ts`. Retirement is owned by
-    // epic A2, after the App is elevated to `contents: write`. Nothing in this
-    // change removes, hides, or downgrades either check, and no merge behaviour is
-    // altered by reporting them.
+    // AC-7 RETIRED HERE (BAPI-1136). The note this replaces said these checks were
+    // load-bearing because "conductor merges run under this machine's own `gh`
+    // auth", and named epic A2 as the owner of their retirement. This IS that A2
+    // child: the merge now authenticates with one explicitly configured,
+    // customer-held credential and never with the ambient session. So the check is
+    // not removed — it is re-pointed at the thing that now decides, which is the
+    // only way it stays load-bearing rather than becoming decorative.
     const outcomes = [
         gh_available
             ? {
@@ -502,28 +521,155 @@ export function inspectLocalMerge(runCommand) {
             },
         !gh_available
             ? {
-                id: "gh-auth",
-                label: "GitHub CLI authentication",
+                id: "merge-credential",
+                label: "Configured merge credential",
                 status: "skip",
                 detail: GH_AUTH_SKIPPED_DETAIL,
                 remediation: GH_CLI_REMEDIATION,
             }
-            : gh_authed
+            : merge_credential_configured
                 ? {
-                    id: "gh-auth",
-                    label: "GitHub CLI authentication",
+                    id: "merge-credential",
+                    label: "Configured merge credential",
                     status: "pass",
-                    detail: "`gh auth status` reports an authenticated account",
+                    detail: "BAPI_LOCAL_MERGE_TOKEN or BAPI_MACHINE_MERGE_TOKEN is set",
                 }
                 : {
-                    id: "gh-auth",
-                    label: "GitHub CLI authentication",
+                    id: "merge-credential",
+                    label: "Configured merge credential",
                     status: "warn",
-                    detail: "`gh` is installed but `gh auth status` failed",
+                    detail: "`gh` is installed but neither BAPI_LOCAL_MERGE_TOKEN nor " +
+                        "BAPI_MACHINE_MERGE_TOKEN is set, so a local merge would fail closed",
                     remediation: GH_AUTH_REMEDIATION,
                 },
     ];
-    return { gh_available, gh_authed, degraded, warnings, outcomes };
+    return { gh_available, merge_credential_configured, degraded, warnings, outcomes };
+}
+/** Remediation when this host has no `gh` identity to observe with. */
+export const GH_ACTIONS_MERGE_AUTH_REMEDIATION = "run `gh auth login` so this host has a GitHub identity; without one it cannot " +
+    "observe the merge capability. This does not affect whether the capability exists.";
+/** Remediation when the capability could not be observed from this host. */
+export const GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION = "check network connectivity to api.github.com and `gh auth status`; the merge " +
+    "capability could NOT BE OBSERVED from this host, which is not the same as it " +
+    "being absent. The server's conductor readiness report is authoritative.";
+/** Detail for the observability outcome when the auth prerequisite never held. */
+export const GH_ACTIONS_MERGE_SKIPPED_DETAIL = "not attempted — this host has no authenticated `gh` identity";
+/**
+ * Read-only probe of whether this host can observe the `github_actions` merge
+ * capability. Never throws.
+ *
+ * Two bounded, read-only commands and nothing else: `gh auth status`, then a
+ * status-only `gh api` GET of the canonical workflow metadata endpoint. The
+ * injected runner returns a STATUS ONLY — it is deliberately not widened to
+ * capture stdout, because parsing that output would mean re-deriving workflow
+ * state the server already reports, from a different identity, with no way to
+ * reconcile a disagreement.
+ *
+ * Every failure mode — a timeout, a non-zero status, a missing `gh`, a thrown
+ * dependency error — degrades to `false` with a retry-oriented warning. None
+ * raises a backend platform alert: an unobservable capability is a LOCAL
+ * condition, and paging on it would page for every laptop behind a proxy.
+ *
+ * Emits only status classifications and fixed remediation text. No process
+ * output, auth detail, repository URL, or command credential appears anywhere in
+ * the result.
+ */
+export function inspectGitHubActionsMerge(runCommand) {
+    const run = runCommand ??
+        ((cmd, args) => {
+            try {
+                // Same structure and bound as `inspectLocalMerge`: a static ESM import,
+                // a 10s timeout so a network stall cannot hold the doctor past it, and
+                // GH_PROMPT_DISABLED so an interactive prompt cannot either.
+                const r = spawnSync(cmd, args, {
+                    encoding: "utf8",
+                    timeout: 10_000,
+                    env: { ...process.env, GH_PROMPT_DISABLED: "1" },
+                });
+                return { status: r.status };
+            }
+            catch {
+                return { status: null };
+            }
+        });
+    let gh_authed = false;
+    try {
+        gh_authed = run("gh", ["auth", "status"]).status === 0;
+    }
+    catch {
+        gh_authed = false;
+    }
+    let capability_observable = false;
+    if (gh_authed) {
+        try {
+            // `--silent` keeps the body out of the child's stdout entirely: this probe
+            // wants the STATUS, and a body it never requests is a body it cannot leak.
+            capability_observable =
+                run("gh", [
+                    "api",
+                    "--silent",
+                    `repos/{owner}/{repo}/actions/workflows/${MERGE_WORKFLOW_IDENTIFIER}`,
+                ]).status === 0;
+        }
+        catch {
+            capability_observable = false;
+        }
+    }
+    const warnings = [];
+    if (!gh_authed) {
+        warnings.push(GH_ACTIONS_MERGE_AUTH_REMEDIATION);
+    }
+    else if (!capability_observable) {
+        warnings.push(GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION);
+    }
+    const outcomes = [
+        gh_authed
+            ? {
+                id: "gh-actions-merge-auth",
+                label: "GitHub Actions merge: local observation prerequisites",
+                status: "pass",
+                detail: "eligible to observe — `gh auth status` reports an authenticated account",
+            }
+            : {
+                id: "gh-actions-merge-auth",
+                label: "GitHub Actions merge: local observation prerequisites",
+                status: "warn",
+                detail: "not observable — no authenticated `gh` identity on this host",
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            },
+        !gh_authed
+            ? {
+                // `skip`, never `fail`: observability was never tested, and claiming it
+                // failed would send the operator to debug connectivity on a host that
+                // simply has no identity yet.
+                id: "gh-actions-merge-observable",
+                label: "GitHub Actions merge: capability observability",
+                status: "skip",
+                detail: GH_ACTIONS_MERGE_SKIPPED_DETAIL,
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            }
+            : capability_observable
+                ? {
+                    id: "gh-actions-merge-observable",
+                    label: "GitHub Actions merge: capability observability",
+                    status: "pass",
+                    detail: "eligible to observe — the workflow metadata endpoint answered",
+                }
+                : {
+                    id: "gh-actions-merge-observable",
+                    label: "GitHub Actions merge: capability observability",
+                    status: "warn",
+                    detail: "could not verify — the workflow metadata endpoint could not be read",
+                    remediation: GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION,
+                },
+    ];
+    return {
+        gh_authed,
+        capability_observable,
+        degraded: !gh_authed || !capability_observable,
+        warnings,
+        outcomes,
+    };
 }
 /**
  * Build the combined read-only doctor report. Composes the existing ledger
@@ -549,12 +695,43 @@ export async function buildConductorDoctorReport(deps = {}) {
         git_hooks: inspectHooks(deps.hooksDeps),
         mcp_profile,
         local_merge: inspectLocalMerge(deps.runCommand),
+        github_actions_merge: inspectGitHubActionsMergeSafe(deps),
         native_ledger,
         deny_enforcement,
         claude_login,
         repair_credentials: await inspectRepairVerbCredentials(deps.env ?? process.env, deps.resolveRepairAccess),
     };
 }
+/**
+ * Run the GitHub Actions merge inspector, containing any throw as degraded data.
+ *
+ * The production inspector is already exception-safe; this is defense in depth
+ * for an INJECTED fake, so a test double that throws degrades the section rather
+ * than failing the whole doctor report.
+ */
+function inspectGitHubActionsMergeSafe(deps) {
+    const inspect = deps.inspectGitHubActionsMerge ?? inspectGitHubActionsMerge;
+    try {
+        return inspect(deps.runCommand);
+    }
+    catch {
+        return {
+            gh_authed: false,
+            capability_observable: false,
+            degraded: true,
+            warnings: [GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION],
+            outcomes: [
+                {
+                    id: "gh-actions-merge-observable",
+                    label: "GitHub Actions merge: capability observability",
+                    status: "warn",
+                    detail: "could not verify — the local inspection could not be completed",
+                    remediation: GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION,
+                },
+            ],
+        };
+    }
+}
 /**
  * Run the deny-enforcement inspector and convert any thrown exception into degraded
  * report data — a deny-probe failure must never throw out of doctor. The underlying
@@ -594,7 +771,7 @@ async function inspectDenyEnforcementSafe(inspect) {
  * hierarchy across sections.
  */
 export function formatConductorDoctorReport(report) {
-    const { ledger, git_hooks, mcp_profile, local_merge, native_ledger, deny_enforcement, claude_login } = report;
+    const { ledger, git_hooks, mcp_profile, local_merge, github_actions_merge, native_ledger, deny_enforcement, claude_login } = report;
     const lines = [
         "Conductor ledger doctor",
         "───────────────────────",
@@ -648,6 +825,7 @@ export function formatConductorDoctorReport(report) {
     // value of `full` is healthy precisely because it resolves to a set containing
     // `conductor`.
     const profileTag = mcp_profile.degraded ? "[WARNING] degraded" : "[OK]";
+    lines.push("Epic Implementer MCP profile");
     lines.push(`raw profile:           ${mcp_profile.raw_profile}`);
     lines.push(`active groups:         ${mcp_profile.active_groups.join(", ")} ${profileTag}`);
     lines.push(`conductor context:     ${mcp_profile.conductor_context_detected}`);
@@ -661,13 +839,38 @@ export function formatConductorDoctorReport(report) {
     lines.push("Local merge capability (optional, opt-in)");
     lines.push("─────────────────────────────────────────");
     const ghTag = local_merge.gh_available
-        ? local_merge.gh_authed
+        ? local_merge.merge_credential_configured
             ? "[OK]"
-            : "[WARNING] not authenticated"
+            : "[WARNING] no merge credential configured"
         : "[WARNING] not installed";
     lines.push(`gh available:          ${local_merge.gh_available} ${ghTag}`);
-    lines.push(`gh authenticated:      ${local_merge.gh_authed}`);
+    lines.push(`merge credential set:  ${local_merge.merge_credential_configured}`);
     lines.push(`degraded:              ${local_merge.degraded}`);
+    // BAPI-1135 — the two observations render INDEPENDENTLY, each leading with its
+    // own decisive word, because they have two different fixes. Collapsing them
+    // into one line would hide which of the two an operator has to act on.
+    //
+    // The vocabulary is deliberate: `not observable` is a statement about THIS
+    // HOST, and `could not verify` is a statement about a read that failed.
+    // Neither ever says the capability is absent — only the server's readiness
+    // report may say that.
+    if (github_actions_merge) {
+        lines.push("");
+        lines.push("GitHub Actions merge (read-only observability)");
+        lines.push(`gh authenticated:      ${github_actions_merge.gh_authed} ${github_actions_merge.gh_authed ? "(eligible to observe)" : "(not observable)"}`);
+        lines.push(`capability observable: ${github_actions_merge.capability_observable} ${github_actions_merge.gh_authed
+            ? github_actions_merge.capability_observable
+                ? "(eligible to observe)"
+                : "(could not verify)"
+            : "(not attempted)"}`);
+        lines.push(`degraded:              ${github_actions_merge.degraded}`);
+        if (github_actions_merge.warnings.length > 0) {
+            lines.push("warnings:");
+            for (const w of github_actions_merge.warnings)
+                lines.push(`  - ${w}`);
+        }
+        lines.push("");
+    }
     if (local_merge.warnings.length > 0) {
         lines.push("local merge warnings:");
         for (const w of local_merge.warnings)
@@ -746,9 +949,9 @@ export function formatConductorDoctorReport(report) {
 export const CONDUCTOR_READINESS_DESCRIPTORS = [
     { id: "ledger", label: "Conductor event ledger" },
     { id: "git-hooks", label: "Conductor git hooks" },
-    { id: "mcp-profile", label: "MCP conductor profile" },
+    { id: "mcp-profile", label: "Epic Implementer MCP profile" },
     { id: "gh-cli", label: "GitHub CLI availability" },
-    { id: "gh-auth", label: "GitHub CLI authentication" },
+    { id: "merge-credential", label: "Configured merge credential" },
     { id: "native-ledger", label: "Native ledger binding" },
     { id: "mcp-registration-form", label: "Worker MCP registration form" },
     { id: "node-engine", label: "Expected Node engine" },
@@ -916,6 +1119,10 @@ export function mapConductorDoctorReportToReadinessChecks(report) {
         record(outcome);
     for (const outcome of outcomesOf(report?.local_merge))
         record(outcome);
+    // BAPI-1135 — both observability outcomes flow through the same readiness-check
+    // mapping as every other doctor outcome, so no surface formats them twice.
+    for (const outcome of outcomesOf(report?.github_actions_merge))
+        record(outcome);
     for (const outcome of outcomesOf(report?.native_ledger))
         record(outcome);
     record(denyEnforcementOutcome(report));

package/build/conductor/epic-implementer-cli.js

@@ -24,7 +24,7 @@ import { ConductorValidationError, ConductorEpicTickV1FrozenError, toConductorEr
 import { emitConductorEvent, purgeConductorLedger, sendWorkerMessage, checkWorkerMessages, } from "./store.js";
 import { isDuplicateConstraintError } from "./producer-ledger.js";
 import { SEMANTIC_EVENT_TYPES } from "./taxonomy.js";
-import { DRIVER_CONTEXT_MAX_BYTES } from "./repair-contract.js";
+import { DRIVER_CONTEXT_MAX_BYTES, POLICY_PATCH_MAX_BYTES } from "./repair-contract.js";
 import { installConductorGitHooks, resolveConductorHookBin } from "./git-hooks.js";
 import { runFileScopeGuardCli } from "./file-scope-guard.js";
 import { runPostCommitHookProducer, runReferenceTransactionHookProducer } from "./git-producer.js";
@@ -94,6 +94,15 @@ export function getConductorUsage() {
         "  merge-child --epic-run-id <id> --pr <number>",
         "                       Merge the run's PR-bound child through the shared merge",
         "                       service; the server composes the head and gate identity.",
+        "  scope-catch-up --epic-run-id <id> --scope-id <scope> [--json]",
+        "                       Replay merges the run's OWN scope did not observe through the",
+        "                       guarded advance gate (no force). Refused if the scope is not the run's.",
+        "  patch-policy --epic-run-id <id> --patch-file <path> [--json]",
+        "                       Merge-patch (RFC 7396) the run's policy on the server. Protected",
+        `                       paths refused; patch at most POLICY_PATCH_MAX_BYTES = ${POLICY_PATCH_MAX_BYTES} bytes.`,
+        "  resume-run --epic-run-id <id> [--clear-quarantine] [--json]",
+        "                       Resume a paused run (a quarantined one only with --clear-quarantine);",
+        "                       activation is re-checked server-side. Active/no-control is a no-op.",
         "",
         "supervise options:",
         "  --run-id <id>             Run/session identifier to supervise (required)",
@@ -168,10 +177,16 @@ export function getConductorUsage() {
         "      --raw-json '{\"branch\":\"feature/x\",\"sha\":\"abc123\"}'",
         "  epic-implementer emit-event --type ci.failed --source ci \\",
         "      --payload-ref 'file:///tmp/ci-log.txt'",
-        "  epic-implementer emit-event --type merge.succeeded --source conductor-merge \\",
+        "  epic-implementer emit-event --type merge.succeeded --source epic-implementer-merge \\",
         "      --worker-id w1 --data-json '{\"summary\":\"auto-merged\",\"status\":\"succeeded\"}'",
         "  epic-implementer doctor --json",
         "  epic-implementer purge",
+        "  epic-implementer scope-catch-up --epic-run-id <id> --scope-id <scope>",
+        "      # a merge landed on epic/<KEY> that the scope never observed (unobserved_advance)",
+        "  epic-implementer patch-policy --epic-run-id <id> --patch-file required-checks.json",
+        "      # required_checks_empty_no_mode; the file holds {\"required_checks\":[\"conductor-ci / gate\"]}",
+        "  epic-implementer resume-run --epic-run-id <id>",
+        "      # a cap_wall_clock pause whose cause is now cleared",
         "",
         "epic-tick options:",
         "  --epic-key <KEY>          Epic key to supervise (required, non-empty)",
@@ -263,6 +278,10 @@ const VALID_COMMANDS = new Set([
     "scope-reparse",
     "dispatch-remediation",
     "merge-child",
+    // BAPI-1176: CLI-only run-addressed repair verbs — never registered as MCP tools.
+    "scope-catch-up",
+    "patch-policy",
+    "resume-run",
     // Private, and deliberately ABSENT from the usage text: `__hook-bin` exists as
     // the bundled-artifact regression guard for BAPI-772 (mirroring `plane
     // __entrypoint`), not as a supported operator workflow.
@@ -833,7 +852,7 @@ export function parseEpicTickArgs(argv) {
 /**
  * Default the PreToolUse hook ON for epic-dispatched workers so the supervisor
  * gets worker-liveness (`tool.intent`) signals without the operator having to
- * export `BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE=1` (BAPI-441/A1 finding).
+ * export `BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE=1` (BAPI-441/A1 finding).
  *
  * Both the child-env copy and the hook registration key off this SAME
  * parent-process env flag, read at dispatch time, so setting it once at the
@@ -843,8 +862,8 @@ export function parseEpicTickArgs(argv) {
  * `process.env`) and returns it.
  */
 export function applyEpicTickPreToolUseDefault(env = process.env) {
-    if (env.BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE === undefined) {
-        env.BAPI_CONDUCTOR_ENABLE_PRE_TOOL_USE = "1";
+    if (env.BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE === undefined) {
+        env.BAPI_EPIC_IMPLEMENTER_ENABLE_PRE_TOOL_USE = "1";
     }
     return env;
 }
@@ -1281,6 +1300,20 @@ export async function runEpicImplementerCli(argv) {
                 const { runMergeChildCommand } = await import("./recovery-cli.js");
                 return await runMergeChildCommand(parsed.argv);
             }
+            // BAPI-1176: three more run-addressed repair verbs — CLI-only, lazily
+            // imported like the rest, and dispatched before any MCP construction.
+            case "scope-catch-up": {
+                const { runScopeCatchUpCommand } = await import("./recovery-cli.js");
+                return await runScopeCatchUpCommand(parsed.argv);
+            }
+            case "patch-policy": {
+                const { runPatchPolicyCommand } = await import("./recovery-cli.js");
+                return await runPatchPolicyCommand(parsed.argv);
+            }
+            case "resume-run": {
+                const { runResumeRunCommand } = await import("./recovery-cli.js");
+                return await runResumeRunCommand(parsed.argv);
+            }
             default:
                 console.error('Error: Unknown command. Run "epic-implementer --help" for usage.');
                 return 1;

package/build/conductor/epic-reconcile.js

@@ -55,7 +55,7 @@ export function safeDiagnosticMessage(err, fallback) {
  *
  * Deliberately diagnostic. The `epic_ticket_status` vocabulary — `parsing`,
  * `needs_human` and the rest — is owned by the SERVER-side reconciler
- * (`api/library/epic_conductor/reconciler.py`), which is the single transition
+ * (`api/library/epic_implementer/reconciler.py`), which is the single transition
  * authority for it and already parks this exact condition through its ordinary
  * `_park_needs_human` commit point under the same `shadow_stale_deadline` reason.
  * This pass runs the legacy supervisor's own, narrower status vocabulary, and