@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/conductor/pr-ci-producer.js

@@ -109,7 +109,7 @@ export function buildGateMetEventInput(binding, evaluation, runId = null, worker
     if (!evaluation.met || !evaluation.gateEventData)
         return null;
     return {
-        source: "conductor",
+        source: "epic-implementer",
         type: "gate.met",
         subject: binding.subject,
         run_id: runId,
@@ -142,8 +142,8 @@ async function observeWithResolved(binding, access, gateConfig, deps, expectedBa
     const now = deps.now ?? (() => new Date().toISOString());
     // Resolve run_id/worker_id for attribution. Env takes precedence; fall back
     // to the injected resolution seam when the env identity is absent.
-    let run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
-    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    let run_id = deps.env?.BAPI_EPIC_IMPLEMENTER_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_EPIC_IMPLEMENTER_WORKER_ID?.trim() || null;
     if (run_id === null && deps.resolveRunId) {
         try {
             run_id = await deps.resolveRunId(access, binding) ?? null;
@@ -432,8 +432,8 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
     }
     // Env-stamp identity; fall back to the resolution seam when env is absent.
     // Access resolution for the seam is attempted inline within the gate block.
-    let run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
-    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    let run_id = deps.env?.BAPI_EPIC_IMPLEMENTER_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_EPIC_IMPLEMENTER_WORKER_ID?.trim() || null;
     const result = {
         binding,
         pr_opened_emitted: false,
@@ -541,7 +541,7 @@ function extractTicketKeyFromRef(headRef) {
  * any step fails — the producer never crashes on a resolution failure.
  *
  * Intended to be injected as `PrCiProducerDeps.resolveRunId` at call sites
- * that lack `BAPI_CONDUCTOR_RUN_ID` in the environment (git-hook / CI-poll
+ * that lack `BAPI_EPIC_IMPLEMENTER_RUN_ID` in the environment (git-hook / CI-poll
  * contexts). A production `fetchImpl` is optional; defaults to the global fetch.
  */
 export async function resolveDispatchRunIdForBinding(access, binding, fetchImpl = fetch) {

package/build/conductor/pr-review-producer.js

@@ -58,8 +58,8 @@ export function buildReviewObservationEventInput(binding, snapshot, eventType, r
 export async function observeReviewWithResolved(binding, access, gateConfig, deps = {}) {
     const fetchStatus = deps.fetchReviewStatus ?? fetchPrReviewStatus;
     const emitIfNew = deps.emitIfNew ?? emitConductorEventIfNew;
-    const run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
-    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    const run_id = deps.env?.BAPI_EPIC_IMPLEMENTER_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_EPIC_IMPLEMENTER_WORKER_ID?.trim() || null;
     const result = {
         snapshot: null,
         review_passed_emitted: false,

package/build/conductor/producer-ledger.js

@@ -33,6 +33,8 @@ export function makeProducerDedupeKey(dimensions) {
  * the `events.id` UNIQUE constraint instead of appending a duplicate.
  */
 export function makeStableProducerEventId(dedupeKey) {
+    // Upgrade seam: preserve the legacy namespace so retries spanning releases
+    // collide with the event ID already written before the wire-name migration.
     const h = createHash("sha256").update(`conductor-producer:${dedupeKey}`).digest("hex");
     return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }

package/build/conductor/readiness-sections.js

@@ -36,10 +36,12 @@
 import { MANAGED_HOOK_NAMES } from "./git-hooks.js";
 import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { CLAUDE_REVIEW_WORKFLOW_DRIFT_REMEDIATION, summarizeClaudeReviewWorkflowDrift, } from "../claude-review-workflow-drift.js";
-import { describeNativeLedgerAvailability } from "./doctor.js";
+import { describeNativeLedgerAvailability, GH_ACTIONS_MERGE_AUTH_REMEDIATION, GH_ACTIONS_MERGE_SKIPPED_DETAIL, GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION, } from "./doctor.js";
+import { classifyMergeExecutionEligibility, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
+import { MERGE_WORKFLOW_EXPECTED_VERSION, MERGE_WORKFLOW_PATH, } from "./merge-execution-contract.js";
 import { classifyDatabaseMigration, classifySingleTransitionAuthority, classifyWorkerPresent, } from "./bring-up-facts.js";
 /** Operator runbook pointer surfaced beside the executor gap. */
-export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-conductor-v2-operator-runbook.md";
+export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-implementer-v2-operator-runbook.md";
 /**
  * Capability-matrix guidance for the executor leg.
  *
@@ -51,13 +53,13 @@ export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-conductor-v2
 export const EXECUTOR_PROVISIONING_GUIDANCE = "`install conductor` writes the unit and starts it, each behind its own consent; " +
     "readiness still comes only from a live server observation";
 /**
- * The `BRIDGE_MCP_PROFILE` token that makes the 8 conductor MCP tools visible.
+ * The `BRIDGE_MCP_PROFILE` token that makes the 8 Epic Implementer MCP tools visible.
  *
  * The tools are profile-gated, never core, and this is the only token that
  * un-gates them — so the doctor names it explicitly rather than describing the
  * gap abstractly (BAPI-775).
  */
-export const CONDUCTOR_PROFILE_TOKEN = "conductor";
+export const EPIC_IMPLEMENTER_PROFILE_TOKEN = "epic_implementer";
 /** Remediation for a host MCP config that carries no Bridge entry at all. */
 export const CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION = "no supported host MCP config carries a Bridge entry — run " +
     `\`npx ${MCP_PACKAGE_NAME} install\` to register one, then re-run \`install conductor\`.`;
@@ -71,7 +73,7 @@ export const CONDUCTOR_HOOK_TARGET_REMEDIATION = "re-run `install conductor` and
 export const CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION = "`better-sqlite3` is an optionalDependency npm silently skips on a build failure — " +
     "reinstall it for this Node runtime to restore local conductor observability.";
 /** Remediation surfaced whenever no healthy generated service unit is detected. */
-export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `install conductor --executor-id <id>` or " +
+export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `install conductor --executor-id <id> --repo-wide` or " +
     "`executor install-service` (or run the executor by hand) — " +
     `see ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`;
 /** Remediation for a unit that exists but whose service is not running. */
@@ -216,6 +218,94 @@ export function githubActionsSection(readiness) {
         remediation: "grant the GitHub App `actions: write`; the conductor's workflow rerun lane fails open on 403 without it.",
     };
 }
+/**
+ * The "Merge execution eligibility" section (BAPI-1135).
+ *
+ * A DEDICATED section rather than extra rows on the GitHub App block, because it
+ * is a different safety diagnostic about a different principal: the App block
+ * describes the installation's dispatch permission, this one describes whether
+ * the repository's merge workflow can actually merge.
+ *
+ * Rows are rendered in DEPENDENCY order — probe/readability, presence, enabled
+ * state, exact version, App `actions: write`, workflow-token write authority,
+ * branch-policy admission — so a reader meets the fact that decided the verdict
+ * before the facts that were never reached.
+ *
+ * Three rendering rules this section holds to:
+ *
+ * * an absent older-server block and a failed probe are explicit UNKNOWN rows,
+ *   never an omitted section and never a pass. "Not reported" is not "healthy";
+ *   omitting the section would make an unknown look like a clean bill of health.
+ * * confirmed policy denial stays verbally distinct from unreadability. The
+ *   status word (`degraded` for unknown, `fatal`-adjacent `degraded` with
+ *   different copy for confirmed) is carried in TEXT, not by colour alone, and
+ *   the detail line opens with `could not verify:` or `not eligible:`.
+ * * command strings, workflow paths, versions, and reason codes are rendered as
+ *   backticked monospace through the established section conventions, and are
+ *   allowed to wrap rather than being truncated — a truncated remedy command is
+ *   not a remedy.
+ */
+export function mergeExecutionSections(readiness) {
+    const verdict = classifyMergeExecutionEligibility(readiness);
+    const m = readiness.merge_execution;
+    if (m === null || m === undefined) {
+        // One row, not seven. Fabricating six more unknown rows from a block that
+        // was never reported would imply the server answered six questions.
+        return [
+            {
+                id: "merge-execution-eligibility",
+                label: "Merge execution eligibility",
+                status: "degraded",
+                detail: `could not verify: ${verdict.detail}`,
+                remediation: verdict.remediation ?? MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION,
+            },
+        ];
+    }
+    const decisive = {
+        id: "merge-execution-eligibility",
+        label: "Merge execution eligibility",
+        status: verdict.status === "eligible" ? "ok" : "degraded",
+        detail: verdict.status === "eligible"
+            ? `eligible: ${verdict.detail}`
+            : verdict.status === "could_not_verify"
+                ? `could not verify: ${verdict.detail}`
+                : `not eligible: ${verdict.detail} (\`${verdict.reason}\`)`,
+        ...(verdict.remediation ? { remediation: verdict.remediation } : {}),
+    };
+    // The supporting facts, in dependency order. Each is a plain readable row — no
+    // remediation of its own, because the decisive row above already names the one
+    // action, and repeating it seven times would bury it.
+    const fact = (id, label, ok, detail) => ({
+        id,
+        label,
+        status: ok ? "ok" : "degraded",
+        detail,
+    });
+    return [
+        decisive,
+        fact("merge-execution-branch-policy-readable", "Branch policy readable", m.branch_protection_probe_succeeded, m.branch_protection_probe_succeeded
+            ? `read on the ${m.branch_scope.replace("_", " ")}`
+            : "could not verify: the branch policy could not be read"),
+        fact("merge-execution-workflow-present", "Merge workflow present", m.merge_workflow_probe_succeeded && m.merge_workflow_present, !m.merge_workflow_probe_succeeded
+            ? "could not verify: the workflow metadata could not be read"
+            : m.merge_workflow_present
+                ? `\`${MERGE_WORKFLOW_PATH}\` present`
+                : `not eligible: \`${MERGE_WORKFLOW_PATH}\` is absent`),
+        fact("merge-execution-workflow-enabled", "Merge workflow enabled", m.merge_workflow_enabled, m.merge_workflow_enabled ? "enabled" : "not eligible: disabled or unknown"),
+        fact("merge-execution-workflow-version", "Merge workflow version", m.merge_workflow_version === MERGE_WORKFLOW_EXPECTED_VERSION, `\`${m.merge_workflow_version ?? "unset"}\` (expected \`${MERGE_WORKFLOW_EXPECTED_VERSION}\`)`),
+        fact("merge-execution-app-actions-write", "GitHub App `actions: write`", readiness.github.actions_write, readiness.github.actions_probe_succeeded
+            ? `actions: \`${readiness.github.actions_permission_level}\``
+            : "could not verify: the App permission could not be checked"),
+        fact("merge-execution-workflow-token-write", "Workflow token write authority", m.merge_workflow_token_write_authority, m.merge_workflow_token_write_authority
+            ? "the merge workflow's own token holds write authority"
+            : "not eligible: the merge workflow's own token does not hold write authority"),
+        fact("merge-execution-actor-admitted", "Branch policy admits the workflow actor", m.branch_protection_actions_bot_admitted, m.branch_protection_probe_succeeded
+            ? m.branch_protection_actions_bot_admitted
+                ? "admitted"
+                : "not eligible: the workflow actor is excluded"
+            : "could not verify: the branch policy could not be read"),
+    ];
+}
 export function reconcilerSection(readiness) {
     const r = readiness.reconciler;
     if (!r.liveness_readable) {
@@ -500,7 +590,7 @@ export function executorObservationSection(readiness) {
  * Whether this host looks like a conductor context.
  *
  * Composed from the two facts already collected: the resolved MCP-profile
- * inspection (`BAPI_CONDUCTOR_ENABLED` or a registered epic-tick schedule) and
+ * inspection (`BAPI_EPIC_IMPLEMENTER_ENABLED` or a registered epic-tick schedule) and
  * the read-only host token inspection. Outside such a context a missing local
  * capability is ADVISORY — reporting it as a gap would train operators of
  * ordinary repositories to ignore this whole part of the report.
@@ -522,7 +612,7 @@ export function detectConductorContext(legacyConductor, profile) {
  * that Codex or Copilot configuration was inspected or changed.
  */
 export function conductorProfileTokenSection(profile, conductorContext) {
-    const base = { id: "conductor-profile-token", label: "MCP conductor profile token" };
+    const base = { id: "epic-implementer-profile-token", label: "Epic Implementer MCP profile token" };
     if (profile === null) {
         return {
             ...base,
@@ -630,10 +720,77 @@ export function conductorHookTargetsSection(legacyConductor, conductorContext) {
  * sanitized failure kind, because the common cause is npm silently skipping an
  * optionalDependency build and that is undiagnosable without the ABI.
  */
+/**
+ * Project the doctor's read-only `github_actions` merge OBSERVABILITY inspection
+ * into this layer's sections (BAPI-1135).
+ *
+ * Projected here rather than formatted inside installation code, for the same
+ * reason every other doctor fact is: the install-time doctor and the advisory
+ * readiness gate must render one classification, and a second formatter in the
+ * installer is how the two come to describe the same probe differently.
+ *
+ * Two sections, never one. `gh` authentication and endpoint reachability are
+ * independently actionable, and a collapsed row would hide which of the two the
+ * operator has to fix.
+ *
+ * These describe THIS HOST's ability to observe — never whether the capability
+ * is sufficient. {@link mergeExecutionSections} owns that, from the server's own
+ * report. The wording keeps them apart deliberately: `not observable` and `could
+ * not verify` here, versus `not eligible` there.
+ */
+export function gitHubActionsMergeObservabilitySections(legacyConductor) {
+    const authBase = {
+        id: "gh-actions-merge-auth",
+        label: "GitHub Actions merge: local observation prerequisites",
+    };
+    const observeBase = {
+        id: "gh-actions-merge-observable",
+        label: "GitHub Actions merge: capability observability",
+    };
+    const inspection = legacyConductor?.github_actions_merge;
+    if (inspection === undefined || inspection === null) {
+        // The doctor was not collected, or predates this inspection. Both rows say
+        // so rather than being omitted — an absent row reads as "fine".
+        const detail = "could not verify — the epic-implementer doctor reported no observation";
+        return [
+            { ...authBase, status: "degraded", detail },
+            { ...observeBase, status: "degraded", detail },
+        ];
+    }
+    return [
+        inspection.gh_authed
+            ? { ...authBase, status: "ok", detail: "eligible to observe — `gh` is authenticated" }
+            : {
+                ...authBase,
+                status: "degraded",
+                detail: "not observable — no authenticated `gh` identity on this host",
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            },
+        !inspection.gh_authed
+            ? {
+                ...observeBase,
+                status: "degraded",
+                detail: GH_ACTIONS_MERGE_SKIPPED_DETAIL,
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            }
+            : inspection.capability_observable
+                ? {
+                    ...observeBase,
+                    status: "ok",
+                    detail: "eligible to observe — the workflow metadata endpoint answered",
+                }
+                : {
+                    ...observeBase,
+                    status: "degraded",
+                    detail: "could not verify — the workflow metadata endpoint could not be read",
+                    remediation: GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION,
+                },
+    ];
+}
 export function conductorLedgerLoadabilitySection(legacyConductor) {
     const base = {
-        id: "conductor-ledger-loadability",
-        label: "Conductor ledger loadability",
+        id: "epic-implementer-ledger-loadability",
+        label: "Epic Implementer ledger loadability",
     };
     if (legacyConductor === null || legacyConductor === undefined) {
         return {

package/build/conductor/readiness.js

@@ -47,19 +47,28 @@
  * a local collector, and the Bridge API owner for a server-side collector that
  * keeps timing out or answering unreadably.
  *
- * ## Deferred retirement: local `gh` (AC-7)
- *
- * **Detection** is `conductor.gh-cli` and `conductor.gh-auth`, carried as two
- * separate checks because installing `gh` and authenticating it are two
- * different operator actions. **Containment** is the existing local-merge
- * execution path, which refuses and emits `merge.failed`/`merge.skipped` rather
- * than merging without auth — a missing `gh` degrades a run, it does not corrupt
- * one. **Escalation** targets the invoking operator first; there is no automated
- * fallback, because the GitHub App token is `contents: read` and structurally
- * cannot merge (see `mcp_server/src/executor/merge-job.ts`). **Retirement** is
- * owned by epic A2, after the App is elevated to `contents: write`. Until A2
- * ships this check is load-bearing and no code here may remove, hide, or
- * downgrade it.
+ * ## RETIRED deferral: local `gh` auth (AC-7, retired by BAPI-1136)
+ *
+ * This deferral named its retirement owner as epic A2, and A2 has now landed.
+ * It is recorded here rather than deleted, because the point of naming an owner
+ * is being able to check afterwards that the owner actually did the work.
+ *
+ * **What it used to be.** Detection was `conductor.gh-cli` and
+ * `conductor.gh-auth`: the merge ran under this host's own `gh` session, because
+ * the GitHub App token is `contents: read` and structurally cannot merge (see
+ * `mcp_server/src/executor/merge-job.ts`). Until A2 shipped, that ambient-session
+ * check was load-bearing.
+ *
+ * **What replaced it.** BAPI-1136 de-personalized the merge: it now authenticates
+ * with one explicitly configured, customer-held credential
+ * (`BAPI_LOCAL_MERGE_TOKEN` or `BAPI_MACHINE_MERGE_TOKEN`) and never with the
+ * ambient session. So the second check was RE-POINTED, not removed —
+ * `conductor.gh-cli` still asks whether `gh` exists, and
+ * `conductor.merge-credential` asks whether a credential is configured. Removing
+ * it would have been a silent downgrade; leaving it would have been worse, since
+ * it reported green on exactly the hosts about to fail closed. **Containment** and
+ * **escalation** are unchanged: the merge refuses with a named reason rather than
+ * merging without a credential, and the invoking operator is the first target.
  *
  * ## Deferred retirement: native SQLite ledger (AC-7)
  *
@@ -89,6 +98,7 @@ import { mapPlanePreflightToReadinessChecks, } from "../plane/preflight.js";
 import { runConductorInstallDoctor, } from "./install-doctor.js";
 import { BRING_UP_SECTION_LABELS } from "./readiness-sections.js";
 import { classifyBringUpFacts } from "./bring-up-facts.js";
+import { classifyMergeExecutionEligibility, MERGE_EXECUTION_INELIGIBLE_REMEDIATION, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
 import { createReadinessCheck, createReadinessCheckSafely, summarizeReadinessChecks, validateReadinessChecks, } from "../readiness-check.js";
 /** This report's own schema version. See the module docstring. */
 export const CONDUCTOR_READINESS_GATE_SCHEMA_VERSION = 1;
@@ -110,6 +120,13 @@ export const SERVER_READINESS_DESCRIPTORS = [
     { id: "review-policy", label: "Review policy" },
     { id: "github-credentials", label: "GitHub App credentials" },
     { id: "github-actions-permission", label: "GitHub App actions permission" },
+    // BAPI-1135 — merge-execution eligibility, BESIDE the App permission row and
+    // never replacing it: that row is the installation's dispatch/rerun
+    // permission, these two are the merge workflow and the branch policy that
+    // governs it. Two rows rather than one, because a workflow that is absent and
+    // a branch policy that excludes the actor are separately actionable.
+    { id: "merge-execution-workflow", label: "Merge workflow eligibility" },
+    { id: "merge-execution-branch-policy", label: "Merge branch policy" },
     // BAPI-1153 — the "Bring-up safety" group: deployment-wide facts that decide
     // whether a plane can drive a run at all, ahead of the repository-scoped
     // reconciler/executor rows. Labels come from the shared section layer.
@@ -163,7 +180,7 @@ const SERVER_REMEDIATIONS = {
     reconcilerUnreadable: "retry once the Bridge API is reachable; reconciler liveness is unknown here, not confirmed stale.",
     reconcilerStale: "start the reconciler for this repository (the `epic-implementer epic-tick` schedule) so ticks resume.",
     executorUnreadable: "retry once the Bridge API is reachable; no executor readiness claim is ever made from local state.",
-    executorNeverSeen: "provision and start an executor (`install conductor --executor-id <id>` or `executor install-service`); readiness comes only from a live server observation.",
+    executorNeverSeen: "provision and start an executor (`install conductor --executor-id <id> --repo-wide` or `executor install-service`); readiness comes only from a live server observation.",
     executorStale: "restart the executor service; it was observed once and has gone quiet past the server's staleness threshold.",
     reviewWorkflowUnknown: "re-run; the default branch's review workflow could not be evaluated, which is not the same as it being absent.",
     reviewWorkflowIncomplete: "install the claude-review workflow template on the default branch so it emits both the run id and the reviewed SHA the verdict protocol reads.",
@@ -175,6 +192,11 @@ const SERVER_REMEDIATIONS = {
     unattendedConsent: "set `unattended_epic_implementer_allowed` for this repository (docs/claude/account-settings-operator-runbook.md), or run setup with --attended.",
     unattendedNotifyDefault: "supply a --policy-file declaring notify.webhook_url, or run setup with --attended; an unattended run must have a working escalation channel, and notify.local_sink is not one.",
     repositoryWorkflowReadiness: "run `install-bridge conductor` so the review and conductor-CI workflows are confirmed on the default branch, or run setup with --attended.",
+    // BAPI-1135. Both are IMPORTED from the shared classifier rather than written
+    // out here, so the remedy command has exactly one spelling across the refusal,
+    // the readiness row, and the doctor — see `merge-execution-contract.ts`.
+    mergeExecutionUnverifiable: MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION,
+    mergeExecutionIneligible: MERGE_EXECUTION_INELIGIBLE_REMEDIATION,
 };
 /**
  * Project the validated server readiness response into `server.*` checks.
@@ -279,6 +301,7 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
             remediation: SERVER_REMEDIATIONS.githubCredentials,
         });
     outcomes.push(githubActionsOutcome(readiness));
+    outcomes.push(...mergeExecutionOutcomes(readiness));
     outcomes.push(...bringUpOutcomes(readiness));
     outcomes.push(reconcilerOutcome(readiness));
     outcomes.push(executorOutcome(readiness));
@@ -460,6 +483,64 @@ function githubActionsOutcome(readiness) {
         remediation: SERVER_REMEDIATIONS.actionsMissing,
     };
 }
+/**
+ * The two BAPI-1135 merge-execution rows.
+ *
+ * Both are backed SOLELY by {@link classifyMergeExecutionEligibility}, so this
+ * gate, the install doctor's section, the `drive-epic` requirement, and the
+ * `setup-epic` refusal cannot disagree about the status or the first blocker.
+ * Nothing here re-reads the server block or re-derives a fact.
+ *
+ * A `could_not_verify` verdict produces a RETRY-oriented row on both, and never
+ * claims the capability is absent. A confirmed insufficiency produces a
+ * `not eligible` row carrying the exact shared remedy command. The two are
+ * deliberately different statuses — `fail` for confirmed, `warn` for unknown —
+ * so the visible status label distinguishes them without relying on colour.
+ *
+ * Which of the two rows carries the blocker is decided by the reason: a branch
+ * policy that could not be read or an actor that is not admitted belongs to the
+ * branch-policy row; everything else belongs to the workflow row. The other row
+ * then reports that it was not reached, rather than showing a misleading pass.
+ */
+function mergeExecutionOutcomes(readiness) {
+    const verdict = classifyMergeExecutionEligibility(readiness);
+    const branchScoped = verdict.reason === "branch_policy_unreadable" || verdict.reason === "actor_not_admitted";
+    if (verdict.status === "eligible") {
+        return [
+            {
+                id: "merge-execution-workflow",
+                status: "pass",
+                detail: verdict.detail,
+            },
+            {
+                id: "merge-execution-branch-policy",
+                status: "pass",
+                detail: "the branch policy admits the workflow actor",
+            },
+        ];
+    }
+    const status = verdict.status === "could_not_verify" ? "warn" : "fail";
+    const remediation = verdict.status === "could_not_verify"
+        ? SERVER_REMEDIATIONS.mergeExecutionUnverifiable
+        : SERVER_REMEDIATIONS.mergeExecutionIneligible;
+    const blocked = {
+        id: branchScoped ? "merge-execution-branch-policy" : "merge-execution-workflow",
+        status,
+        detail: verdict.status === "could_not_verify"
+            ? `could not verify: ${verdict.detail}`
+            : `not eligible: ${verdict.detail}`,
+        remediation,
+    };
+    // The row that did not decide reports exactly that. Showing it as a pass would
+    // claim evidence the classifier stopped short of gathering.
+    const notReached = {
+        id: branchScoped ? "merge-execution-workflow" : "merge-execution-branch-policy",
+        status: "warn",
+        detail: "could not verify: not evaluated — an earlier merge-eligibility fact decided first",
+        remediation,
+    };
+    return branchScoped ? [notReached, blocked] : [blocked, notReached];
+}
 /** Reconciler liveness, preserving the server's own `stale` conclusion. */
 function reconcilerOutcome(readiness) {
     const r = readiness.reconciler;
@@ -626,8 +707,8 @@ const INSTALL_SECTION_IDS_OWNED_ELSEWHERE = new Set([
     "server-readiness",
     "bridge-access",
     // Local conductor facts — owned by `mapConductorDoctorReportToReadinessChecks`.
-    "conductor-ledger",
-    "conductor-ledger-loadability",
+    "epic-implementer-ledger",
+    "epic-implementer-ledger-loadability",
     // Legacy embedded reports — owned by their own adapters.
     "install-status",
 ]);