@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/conductor/recovery-cli.js

@@ -1,19 +1,21 @@
 /**
- * `conductor` operator recovery and repair verbs — seven CLI-only commands.
+ * `conductor` operator recovery and repair verbs — ten CLI-only commands.
  *
  * The four BAPI-872 recovery verbs: `stop-run`, `abandon-run`, `unpark`,
- * `adopt-current-head-and-unpark`. The three BAPI-1154 run-addressed repair
- * verbs: `scope-reparse`, `dispatch-remediation`, `merge-child`.
+ * `adopt-current-head-and-unpark`. The six run-addressed repair verbs: BAPI-1154's
+ * `scope-reparse`, `dispatch-remediation`, `merge-child`, and BAPI-1176's
+ * `scope-catch-up`, `patch-policy`, `resume-run`.
  *
  * CLI-only by design — this is an explicit ticket non-goal, not an oversight:
- * none of these seven command names is ever registered as an MCP tool, tool
+ * none of these ten command names is ever registered as an MCP tool, tool
  * description, or generated tool-schema input (`index-static.test.ts` guards
  * this). They exist so an operator (or `plane down`, via
  * `recovery-operations.ts`) can recover a stuck run or ticket WITHOUT
  * hand-rolling an HTTP request, a DAL call, or a code edit.
  *
  * Every ticket command's `row_version` CAS handling is entirely internal to
- * `recovery-operations.ts`. This surface never accepts, echoes, or asks the
+ * `recovery-operations.ts`, and `resume-run`'s control-generation CAS is entirely
+ * the server's. This surface never accepts, echoes, or asks the
  * operator for a version counter — see {@link REJECTED_VERSION_FLAGS}. Every
  * repair verb takes a mandatory `--epic-run-id`; the SERVER decides whether its
  * target belongs to that run, and a foreign target is refused with nothing
@@ -21,7 +23,7 @@
  */
 import { readFile } from "node:fs/promises";
 import { ConductorValidationError, toConductorErrorEnvelope } from "./errors.js";
-import { DRIVER_CONTEXT_MAX_BYTES } from "./repair-contract.js";
+import { DRIVER_CONTEXT_MAX_BYTES, POLICY_PATCH_MAX_BYTES } from "./repair-contract.js";
 // ---------------------------------------------------------------------------
 // Flag parsing
 // ---------------------------------------------------------------------------
@@ -32,12 +34,15 @@ const RECOVERY_BOOL_FLAGS = new Set(["--json", "--help"]);
  * Every spelling of an operator-supplied version counter this surface must
  * refuse outright (BAPI-872) — row_version handling is internal to
  * {@link module:./recovery-operations}, and no ticket command may accept one.
+ * BAPI-1176 adds the run-control generation: `resume-run`'s CAS is the server's.
  */
 const REJECTED_VERSION_FLAGS = new Set([
     "--row-version",
     "--expected-row-version",
     "--row_version",
     "--expected_row_version",
+    "--expected-generation",
+    "--expected_generation",
 ]);
 /**
  * Tokenize `--flag value` / `--flag=value` / boolean flags for the recovery
@@ -64,6 +69,10 @@ function tokenizeRecoveryFlags(argv, valueFlags, boolFlags) {
                 "current version itself.");
         }
         if (boolFlags.has(name)) {
+            if (bools.has(name)) {
+                // Refused like a repeated value flag rather than silently collapsed.
+                throw new ConductorValidationError(`Flag "${name}" may be given only once.`);
+            }
             bools.add(name);
             continue;
         }
@@ -407,12 +416,13 @@ export function decodeDriverContextFile(bytes) {
 }
 /**
  * Render a repair outcome. Human mode prints the verb and run first, the target
- * second, ONE labeled `Before → After` pair third, then `committed` and `event
- * recorded` — a replay is a successful no-op (`committed: false`), never a
- * refusal. `--json` prints the server's bounded result object exactly, or a
- * bounded `{ok:false, kind, code, message}` failure. Nothing here can print a
- * prompt, driver context, row version, action key, head SHA, or credential: the
- * results carry none of them.
+ * second, ONE labeled `Before → After` pair third, then whether this call
+ * `applied` a change or found it `already current / no change`, then `committed`
+ * and `event recorded` — a replay is a successful no-op (`committed: false`),
+ * never a refusal. `--json` prints the server's bounded result object exactly, or
+ * a bounded `{ok:false, kind, code, message}` failure. Nothing here can print a
+ * prompt, driver context, policy value, row version, generation, action key, head
+ * SHA, or credential: the results carry none of them.
  */
 function renderRepairResult(outcome, input, json, extraLines = () => []) {
     if (outcome.ok && outcome.result.committed && !outcome.result.event_recorded) {
@@ -449,6 +459,7 @@ function renderRepairResult(outcome, input, json, extraLines = () => []) {
         `${input.verb} — run ${input.epicRunId}`,
         `  target:          ${input.targetLabel}`,
         `  ${input.stateLabel}: ${result.before ?? "none"} → ${result.after ?? "none"}`,
+        `  result:          ${result.committed ? "applied" : "already current / no change"}`,
         ...extraLines(result),
         `  committed:       ${result.committed}${result.committed ? "" : " (already in this state; no change made)"}`,
         `  event recorded:  ${result.event_recorded}`,
@@ -590,3 +601,223 @@ export async function runMergeChildCommand(argv) {
         return 1;
     }
 }
+// ---------------------------------------------------------------------------
+// BAPI-1176 — repair verbs: scope-catch-up, patch-policy, resume-run
+// ---------------------------------------------------------------------------
+const SCOPE_CATCH_UP_VALUE_FLAGS = new Set(["--epic-run-id", "--scope-id"]);
+const PATCH_POLICY_VALUE_FLAGS = new Set(["--epic-run-id", "--patch-file"]);
+const RESUME_RUN_VALUE_FLAGS = new Set(["--epic-run-id"]);
+/** `--clear-quarantine` is a `resume-run` switch only; no other verb accepts it. */
+const RESUME_RUN_BOOL_FLAGS = new Set(["--json", "--help", "--clear-quarantine"]);
+export function parseScopeCatchUpArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, SCOPE_CATCH_UP_VALUE_FLAGS, RECOVERY_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return { epicRunId: "", scopeId: "", json: bools.has("--json"), help: true };
+    }
+    return {
+        epicRunId: requireFlag(values, "--epic-run-id"),
+        scopeId: requireFlag(values, "--scope-id"),
+        json: bools.has("--json"),
+        help: false,
+    };
+}
+export function parsePatchPolicyArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, PATCH_POLICY_VALUE_FLAGS, RECOVERY_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return { epicRunId: "", patchFile: "", json: bools.has("--json"), help: true };
+    }
+    return {
+        epicRunId: requireFlag(values, "--epic-run-id"),
+        patchFile: requireFlag(values, "--patch-file"),
+        json: bools.has("--json"),
+        help: false,
+    };
+}
+export function parseResumeRunArgs(argv) {
+    const { values, bools } = tokenizeRecoveryFlags(argv, RESUME_RUN_VALUE_FLAGS, RESUME_RUN_BOOL_FLAGS);
+    if (bools.has("--help")) {
+        return {
+            epicRunId: "",
+            clearQuarantine: bools.has("--clear-quarantine"),
+            json: bools.has("--json"),
+            help: true,
+        };
+    }
+    return {
+        epicRunId: requireFlag(values, "--epic-run-id"),
+        clearQuarantine: bools.has("--clear-quarantine"),
+        json: bools.has("--json"),
+        help: false,
+    };
+}
+/**
+ * Validate and decode a `patch-policy` file's BYTES into a merge-patch object.
+ *
+ * Checked in the order that keeps a rejected file from being decoded, parsed,
+ * resolved against credentials, or transmitted: the raw byte length first (against
+ * the SAME `POLICY_PATCH_MAX_BYTES` the server enforces), then a FATAL UTF-8
+ * decode, then `JSON.parse`, then the shape — a non-empty JSON object. Every error
+ * names its category and never echoes the file's content. A `JSON.parse` message
+ * is never forwarded, because V8 quotes the offending text in it.
+ */
+export function decodePolicyPatchFile(bytes) {
+    if (bytes.byteLength > POLICY_PATCH_MAX_BYTES) {
+        throw new ConductorValidationError(`--patch-file is ${bytes.byteLength} bytes, over POLICY_PATCH_MAX_BYTES ` +
+            `(${POLICY_PATCH_MAX_BYTES} UTF-8 bytes). Shorten it and retry; nothing was sent.`);
+    }
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new ConductorValidationError("--patch-file must be valid UTF-8 text; nothing was sent.");
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new ConductorValidationError("--patch-file is not valid JSON; nothing was sent.");
+    }
+    if (value === null) {
+        throw new ConductorValidationError("--patch-file must hold a JSON object, not null; nothing was sent.");
+    }
+    if (Array.isArray(value)) {
+        throw new ConductorValidationError("--patch-file must hold a JSON object, not an array; nothing was sent.");
+    }
+    if (typeof value !== "object") {
+        throw new ConductorValidationError("--patch-file must hold a JSON object, not a scalar value; nothing was sent.");
+    }
+    if (Object.keys(value).length === 0) {
+        throw new ConductorValidationError("--patch-file is an empty object; a merge patch must change at least one key. " +
+            "Nothing was sent.");
+    }
+    return value;
+}
+const SCOPE_CATCH_UP_USAGE = [
+    "Usage: epic-implementer scope-catch-up --epic-run-id <id> --scope-id <scope> [--json]",
+    "",
+    "Replay merges the run's OWN index scope did not observe, through the same guarded",
+    "advance gate the merge webhook uses. There is no force: a blocked advance is",
+    "refused (SCOPE_CATCH_UP_REFUSED). The scope must be the one bound to the named",
+    "run, or the server refuses it (TICKET_NOT_IN_RUN) with nothing written. Prints",
+    "the scope lifecycle before → after; it does not wait for a scheduled parse.",
+].join("\n");
+export async function runScopeCatchUpCommand(argv) {
+    try {
+        const parsed = parseScopeCatchUpArgs(argv);
+        if (parsed.help) {
+            console.log(SCOPE_CATCH_UP_USAGE);
+            return 0;
+        }
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { scopeCatchUpRepair } = await import("./recovery-operations.js");
+        const outcome = await scopeCatchUpRepair(access, {
+            epicRunId: parsed.epicRunId,
+            scopeId: parsed.scopeId,
+        });
+        return renderRepairResult(outcome, {
+            verb: "scope-catch-up",
+            epicRunId: parsed.epicRunId,
+            targetLabel: `scope ${parsed.scopeId}`,
+            stateLabel: "scope lifecycle",
+        }, parsed.json, (result) => [
+            `  outcome:         ${result.outcome}${result.parse_scheduled ? " (parse scheduled)" : ""}`,
+        ]);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}
+const PATCH_POLICY_USAGE = [
+    "Usage: epic-implementer patch-policy --epic-run-id <id> --patch-file <path> [--json]",
+    "",
+    "Apply a JSON merge patch (RFC 7396) to the run's policy ON THE SERVER: it reads",
+    "the stored policy, merges your patch, validates the result, and writes it. You",
+    "never send or see the whole policy, so a value you cannot see is never dropped.",
+    "A null deletes a key. Protected paths (base_branch, notify.webhook_url, and",
+    "server-retained keys) are refused. For a whole replacement use",
+    "`setup-epic --replace-policy`.",
+    "",
+    "--patch-file must hold a non-empty JSON object of at most POLICY_PATCH_MAX_BYTES",
+    `(${POLICY_PATCH_MAX_BYTES} bytes). Its contents are never printed; the result names only`,
+    "the changed dotted paths and before/after policy digest tokens.",
+].join("\n");
+export async function runPatchPolicyCommand(argv, deps = {}) {
+    try {
+        const parsed = parsePatchPolicyArgs(argv);
+        if (parsed.help) {
+            console.log(PATCH_POLICY_USAGE);
+            return 0;
+        }
+        // Read and validate the patch BEFORE credentials are resolved or the HTTP
+        // graph is loaded, so an invalid file costs nothing and reaches no one.
+        let bytes;
+        try {
+            bytes = await (deps.readFile ?? ((p) => readFile(p)))(parsed.patchFile);
+        }
+        catch {
+            throw new ConductorValidationError("--patch-file could not be read; nothing was sent.");
+        }
+        const mergePatch = decodePolicyPatchFile(bytes);
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { patchPolicyRepair } = await import("./recovery-operations.js");
+        const outcome = await patchPolicyRepair(access, {
+            epicRunId: parsed.epicRunId,
+            mergePatch,
+        });
+        return renderRepairResult(outcome, {
+            verb: "patch-policy",
+            epicRunId: parsed.epicRunId,
+            targetLabel: "run policy",
+            stateLabel: "policy digest",
+        }, parsed.json, (result) => [
+            `  policy paths:    ${result.policy_paths.length > 0 ? result.policy_paths.join(", ") : "none"}`,
+        ]);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}
+const RESUME_RUN_USAGE = [
+    "Usage: epic-implementer resume-run --epic-run-id <id> [--clear-quarantine] [--json]",
+    "",
+    "Clear a paused run's control record and return it to active, after the server",
+    "re-checks the run's activation requirements. A quarantined run resumes only with",
+    "--clear-quarantine; a stopped run never resumes (start a new run). A run that is",
+    "already active with no control record is a successful no-op. The server retries",
+    "a concurrent control change itself — never supply a generation.",
+].join("\n");
+export async function runResumeRunCommand(argv) {
+    try {
+        const parsed = parseResumeRunArgs(argv);
+        if (parsed.help) {
+            console.log(RESUME_RUN_USAGE);
+            return 0;
+        }
+        const access = await resolveRecoveryAccess(parsed.json);
+        if (!access)
+            return 1;
+        const { resumeRunRepair } = await import("./recovery-operations.js");
+        const outcome = await resumeRunRepair(access, {
+            epicRunId: parsed.epicRunId,
+            clearQuarantine: parsed.clearQuarantine,
+        });
+        return renderRepairResult(outcome, {
+            verb: "resume-run",
+            epicRunId: parsed.epicRunId,
+            targetLabel: parsed.clearQuarantine ? "run control (clear quarantine)" : "run control",
+            stateLabel: "run control",
+        }, parsed.json);
+    }
+    catch (error) {
+        console.error(`Error: ${toConductorErrorEnvelope(error).message}`);
+        return 1;
+    }
+}

package/build/conductor/recovery-operations.js

@@ -2,8 +2,9 @@
  * Shared Bridge API operator-recovery operations (BAPI-872).
  *
  * Centralizes stop, abandon, ticket unpark/adopt-current-head-and-unpark, and
- * (BAPI-1154) the three run-addressed repair verbs — scope-reparse,
- * dispatch-remediation, merge-child — so
+ * the six run-addressed repair verbs — (BAPI-1154) scope-reparse,
+ * dispatch-remediation, merge-child and (BAPI-1176) scope-catch-up,
+ * patch-policy, resume-run — so
  * the conductor CLI recovery verbs (`recovery-cli.ts`) and `plane down`
  * (`../plane/shutdown.ts`, wired through `../plane/cli.ts`) share EXACTLY the
  * same stop semantics, and so this module — never a caller — owns every
@@ -17,9 +18,9 @@
  * callers: `recovery-cli.ts` and `plane/shutdown.ts`.
  */
 import { randomUUID } from "crypto";
-import { adoptCurrentHeadAndUnparkTicket, completeMergeChild, ConductorBridgeApiError, dispatchRemediation, fetchEpicRunState, mergeChild, safeDiagnosticMessage, scopeReparse, stopEpicRun, unparkEpicTicket, updateEpicRunStatus, } from "./bridge-api-client.js";
+import { adoptCurrentHeadAndUnparkTicket, completeMergeChild, ConductorBridgeApiError, dispatchRemediation, fetchEpicRunState, mergeChild, patchPolicy, resumeRun, safeDiagnosticMessage, scopeCatchUp, scopeReparse, stopEpicRun, unparkEpicTicket, updateEpicRunStatus, } from "./bridge-api-client.js";
 import { DEFAULT_GATE_NAME } from "./git-ci-types.js";
-import { resolveLocalMergeMethod, runApprovedLocalMerge } from "./local-merge.js";
+import { resolveLocalMergeCredential, resolveLocalMergeMethod, runApprovedLocalMerge, } from "./local-merge.js";
 /**
  * Bounded total attempts for a ticket-recovery CAS retry loop. Each attempt
  * begins with a fresh, authoritative state read — so this bounds full
@@ -223,7 +224,11 @@ export async function adoptCurrentHeadAndUnparkWithRetry(access, options) {
 }
 /**
  * Classify a thrown client error. A 4xx carrying a server `error_code` is a
- * NAMED refusal and keeps that code; everything else (transport, timeout, 5xx
+ * NAMED refusal and keeps that code — whether it is one of the closed repair
+ * codes in `repair-contract.ts` or an established pass-through code the server's
+ * own posture, activation, or run-control checks emit (`RUN_CONTROL_MALFORMED`,
+ * for example). Both are rendered from server-owned error data; this layer never
+ * rewrites or re-infers a code. Everything else (transport, timeout, 5xx
  * without a code, an unparseable body) is `unavailable` with a bounded
  * diagnostic. No raw body, URL, header, or credential ever reaches either shape.
  */
@@ -307,7 +312,13 @@ export async function mergeChildRepair(access, options, deps = {}) {
             // which is discarded — never the server's action key, which the server
             // recomposes itself at completion.
             action_key: `merge-child:${options.epicRunId}:${options.prNumber}`,
-        }, { method: resolveLocalMergeMethod(local.merge_method) }, { env: deps.env ?? process.env });
+        }, { method: resolveLocalMergeMethod(local.merge_method) }, 
+        // BAPI-1136: an explicitly configured local credential, never the ambient
+        // login. `env` remains the source of the allowlisted operational base only.
+        {
+            env: deps.env ?? process.env,
+            credential: resolveLocalMergeCredential(deps.env ?? process.env, "local"),
+        });
         succeeded = localResult.status === "succeeded";
         alreadyMerged = succeeded && localResult.reason === "already_merged";
         failureReason = boundedLocalMergeReason(localResult.reason);
@@ -340,3 +351,50 @@ export async function mergeChildRepair(access, options, deps = {}) {
         return classifyRepairError(err, "merge-child completion failed");
     }
 }
+// ---------------------------------------------------------------------------
+// BAPI-1176 — scope-catch-up, patch-policy, resume-run
+// ---------------------------------------------------------------------------
+// Thin like scope-reparse: one mutation call, the server's result returned
+// verbatim, every failure through the shared classifier.
+/**
+ * Catch the run's own index scope up with merges it did not observe. The server
+ * decides ownership, and a blocked advance is a refusal — never a forced repair.
+ */
+export async function scopeCatchUpRepair(access, options, deps = {}) {
+    try {
+        const call = deps.scopeCatchUp ?? scopeCatchUp;
+        return { ok: true, result: await call(access, options) };
+    }
+    catch (err) {
+        return classifyRepairError(err, "scope-catch-up request failed");
+    }
+}
+/**
+ * Apply a merge patch to the run's policy. `mergePatch` must already be a
+ * validated non-empty object within `POLICY_PATCH_MAX_BYTES`; the server does the
+ * read, merge, validation, and guarded write, and reports only path names and
+ * digest tokens.
+ */
+export async function patchPolicyRepair(access, options, deps = {}) {
+    try {
+        const call = deps.patchPolicy ?? patchPolicy;
+        return { ok: true, result: await call(access, options) };
+    }
+    catch (err) {
+        return classifyRepairError(err, "patch-policy request failed");
+    }
+}
+/**
+ * Resume a paused run, or a quarantined one with `clearQuarantine`. The server
+ * re-evaluates activation and owns the control-generation CAS retry; nothing here
+ * reads or sends a generation.
+ */
+export async function resumeRunRepair(access, options, deps = {}) {
+    try {
+        const call = deps.resumeRun ?? resumeRun;
+        return { ok: true, result: await call(access, options) };
+    }
+    catch (err) {
+        return classifyRepairError(err, "resume-run request failed");
+    }
+}

package/build/conductor/repair-contract.js

@@ -1,10 +1,11 @@
 /**
- * The shared contract for the run-addressed operator repair verbs (BAPI-1154):
- * `scope-reparse`, `dispatch-remediation`, and `merge-child`.
+ * The shared contract for the six run-addressed operator repair verbs: BAPI-1154's
+ * `scope-reparse`, `dispatch-remediation`, and `merge-child`, and BAPI-1176's
+ * `scope-catch-up`, `patch-policy`, and `resume-run`.
  *
  * CLI-only, exactly like the BAPI-872 recovery verbs: none of these names is ever
  * registered as an MCP tool (`index-static.test.ts` pins that). This module is the
- * TypeScript mirror of `api/library/epic_conductor/operator_repair_contract.py` —
+ * TypeScript mirror of `api/library/epic_implementer/operator_repair_contract.py` —
  * the verb names, the CLOSED refusal-code table, the driver-context byte cap, and
  * the bounded result shapes the Bridge client returns. A parity test keeps the two
  * aligned; the CLI renders the server's code and never infers ownership or state
@@ -16,11 +17,17 @@
 export const VERB_SCOPE_REPARSE = "scope-reparse";
 export const VERB_DISPATCH_REMEDIATION = "dispatch-remediation";
 export const VERB_MERGE_CHILD = "merge-child";
+export const VERB_SCOPE_CATCH_UP = "scope-catch-up";
+export const VERB_PATCH_POLICY = "patch-policy";
+export const VERB_RESUME_RUN = "resume-run";
 /** Every repair verb, in the order an operator meets them. */
 export const OPERATOR_REPAIR_VERBS = [
     VERB_SCOPE_REPARSE,
     VERB_DISPATCH_REMEDIATION,
     VERB_MERGE_CHILD,
+    VERB_SCOPE_CATCH_UP,
+    VERB_PATCH_POLICY,
+    VERB_RESUME_RUN,
 ];
 /**
  * The ONE cap on driver context, in UTF-8 BYTES — the same number the server
@@ -29,7 +36,24 @@ export const OPERATOR_REPAIR_VERBS = [
  * see the operator's complete instruction or none of it.
  */
 export const DRIVER_CONTEXT_MAX_BYTES = 16384;
-/** The closed refusal-code vocabulary, mirroring the server table. */
+/**
+ * The ONE cap on a `patch-policy` merge patch, in UTF-8 BYTES — the same number the
+ * server enforces (`POLICY_PATCH_MAX_BYTES` in `operator_repair_contract.py`). The
+ * CLI checks the patch file's raw bytes before decoding it, so an over-cap patch is
+ * never parsed, printed, or transmitted.
+ */
+export const POLICY_PATCH_MAX_BYTES = 16384;
+/**
+ * The closed refusal-code vocabulary, mirroring the server table.
+ *
+ * Deliberately NOT every code a repair verb can render. `patch-policy` and
+ * `resume-run` run the server's established posture and unattended-activation
+ * checks, and `resume-run` its run-control validation; those refuse with their OWN
+ * structured codes (for example `RUN_CONTROL_MALFORMED`). Such pass-through codes
+ * are not members of this table, yet the CLI renders them exactly like the closed
+ * codes: every refusal is classified from the server's structured `error_code`,
+ * never from this list and never from error prose.
+ */
 export const OPERATOR_REPAIR_REFUSAL_CODES = [
     "TICKET_NOT_IN_RUN",
     "DRIVER_CONTEXT_INVALID",
@@ -50,6 +74,16 @@ export const OPERATOR_REPAIR_REFUSAL_CODES = [
     "MERGE_GATE_UNRESOLVABLE",
     "MERGE_NOT_COMPLETED",
     "MERGE_COMPLETION_REFUSED",
+    // BAPI-1176
+    "SCOPE_CATCH_UP_REFUSED",
+    "SCOPE_CATCH_UP_UNAVAILABLE",
+    "POLICY_PATCH_INVALID",
+    "POLICY_PATH_NOT_PATCHABLE",
+    "POLICY_CHANGED_CONCURRENTLY",
+    "RUN_NOT_RESUMABLE",
+    "RUN_STOPPED",
+    "QUARANTINE_CLEARANCE_REQUIRED",
+    "RUN_CONTROL_CONFLICT",
 ];
 /** True when `code` is one of the closed repair refusal codes. */
 export function isOperatorRepairRefusalCode(code) {

package/build/conductor/spec-review-producer.js

@@ -3,7 +3,7 @@
  *
  * Emits the spec re-review verdict (`spec_review.passed` /
  * `spec_review.changes_requested`) into the LOCAL conductor ledger, correlated
- * to the spec-review run via `BAPI_CONDUCTOR_RUN_ID`. The Epic Supervisor's
+ * to the spec-review run via `BAPI_EPIC_IMPLEMENTER_RUN_ID`. The Epic Supervisor's
  * reconcile pass folds these signals: `passed` → `reviewing → ready` (proceed to
  * implementation), `changes_requested` → `blocked` (escalate; do NOT implement).
  *
@@ -11,7 +11,7 @@
  * ledger is a per-worker SQLite file (`~/.config/bridge/events.db`). The
  * Heroku-hosted Bridge API backend has no access to it. So — exactly like the
  * PR-review producer ({@link ./pr-review-producer}) — the verdict is emitted by
- * the LOCAL spec-review run, whose environment carries `BAPI_CONDUCTOR_RUN_ID`
+ * the LOCAL spec-review run, whose environment carries `BAPI_EPIC_IMPLEMENTER_RUN_ID`
  * (injected at dispatch time by {@link ../review-tickets}.orchestrateReviewTickets
  * when an epic identity is present). This corrects the original BAPI-445 plan,
  * which proposed emitting from the backend review webhook
@@ -64,15 +64,15 @@ export function buildSpecReviewVerdictEventInput(ticketKey, verdict, reason, run
 }
 /**
  * Emit a spec re-review verdict for `ticketKey` into the local conductor ledger,
- * correlated to the spec-review run via `BAPI_CONDUCTOR_RUN_ID` (read from the
+ * correlated to the spec-review run via `BAPI_EPIC_IMPLEMENTER_RUN_ID` (read from the
  * injected env). Idempotent: deduped by `event_type` + `run_id`, so re-emitting
  * the same run's verdict is a no-op. A missing run id still emits (uncorrelated)
  * but is logged in the result so callers can detect the misconfiguration.
  */
 export async function emitSpecReviewVerdict(ticketKey, verdict, reason, deps = {}) {
     const emitIfNew = deps.emitIfNew ?? emitConductorEventIfNew;
-    const run_id = deps.env?.BAPI_CONDUCTOR_RUN_ID?.trim() || null;
-    const worker_id = deps.env?.BAPI_CONDUCTOR_WORKER_ID?.trim() || null;
+    const run_id = deps.env?.BAPI_EPIC_IMPLEMENTER_RUN_ID?.trim() || null;
+    const worker_id = deps.env?.BAPI_EPIC_IMPLEMENTER_WORKER_ID?.trim() || null;
     const eventType = verdict === "passed" ? SPEC_REVIEW_PASSED : SPEC_REVIEW_CHANGES_REQUESTED;
     const event = buildSpecReviewVerdictEventInput(ticketKey, verdict, reason, run_id, worker_id);
     const decision = await emitIfNew(event, {
@@ -83,6 +83,6 @@ export async function emitSpecReviewVerdict(ticketKey, verdict, reason, deps = {
         emitted: decision.emitted,
         event_type: eventType,
         run_id,
-        reason: run_id ? reason : `${reason} (warning: no BAPI_CONDUCTOR_RUN_ID — verdict uncorrelated)`,
+        reason: run_id ? reason : `${reason} (warning: no BAPI_EPIC_IMPLEMENTER_RUN_ID — verdict uncorrelated)`,
     };
 }

package/build/conductor/store.js

@@ -191,16 +191,16 @@ function parseBoundedInt(raw, fallback, min, max) {
 }
 /**
  * Resolve store configuration from environment with safe defaults and bounds.
- *   - `BAPI_CONDUCTOR_BUSY_TIMEOUT_MS` (default 10000, clamped [250, 120000]).
- *   - `BAPI_CONDUCTOR_RETENTION_DAYS` (default 30). A value <= 0 DISABLES
+ *   - `BAPI_EPIC_IMPLEMENTER_BUSY_TIMEOUT_MS` (default 10000, clamped [250, 120000]).
+ *   - `BAPI_EPIC_IMPLEMENTER_RETENTION_DAYS` (default 30). A value <= 0 DISABLES
  *     age-based retention; positive values are clamped to [1, 3650].
- *   - `BAPI_CONDUCTOR_RETENTION_MAX_ROWS` (default 50000). A value <= 0 DISABLES
+ *   - `BAPI_EPIC_IMPLEMENTER_RETENTION_MAX_ROWS` (default 50000). A value <= 0 DISABLES
  *     the row cap; positive values are clamped to [100, 10000000].
  */
 export function resolveConductorStoreConfig(env = process.env) {
-    const busy_timeout_ms = parseBoundedInt(env.BAPI_CONDUCTOR_BUSY_TIMEOUT_MS, BUSY_TIMEOUT_DEFAULT, BUSY_TIMEOUT_MIN, BUSY_TIMEOUT_MAX);
+    const busy_timeout_ms = parseBoundedInt(env.BAPI_EPIC_IMPLEMENTER_BUSY_TIMEOUT_MS, BUSY_TIMEOUT_DEFAULT, BUSY_TIMEOUT_MIN, BUSY_TIMEOUT_MAX);
     // Retention days: <= 0 disables (sentinel 0); positive values clamped.
-    const rawDays = env.BAPI_CONDUCTOR_RETENTION_DAYS;
+    const rawDays = env.BAPI_EPIC_IMPLEMENTER_RETENTION_DAYS;
     let retention_days = RETENTION_DAYS_DEFAULT;
     if (rawDays !== undefined && rawDays.trim().length > 0) {
         const parsed = Number.parseInt(rawDays.trim(), 10);
@@ -215,7 +215,7 @@ export function resolveConductorStoreConfig(env = process.env) {
         }
     }
     // Retention max rows: <= 0 disables (sentinel 0); positive values clamped.
-    const rawRows = env.BAPI_CONDUCTOR_RETENTION_MAX_ROWS;
+    const rawRows = env.BAPI_EPIC_IMPLEMENTER_RETENTION_MAX_ROWS;
     let retention_max_rows = RETENTION_MAX_ROWS_DEFAULT;
     if (rawRows !== undefined && rawRows.trim().length > 0) {
         const parsed = Number.parseInt(rawRows.trim(), 10);
@@ -230,7 +230,7 @@ export function resolveConductorStoreConfig(env = process.env) {
         }
     }
     // Message relay cooldown: <= 0 disables (sentinel 0); positive values clamped.
-    const rawCooldown = env.BAPI_CONDUCTOR_MESSAGE_COOLDOWN_MS;
+    const rawCooldown = env.BAPI_EPIC_IMPLEMENTER_MESSAGE_COOLDOWN_MS;
     let message_cooldown_ms = MESSAGE_COOLDOWN_DEFAULT_MS;
     if (rawCooldown !== undefined && rawCooldown.trim().length > 0) {
         const parsed = Number.parseInt(rawCooldown.trim(), 10);
@@ -1211,7 +1211,7 @@ export async function sendWorkerMessage(input, config = resolveConductorStoreCon
         : config.message_cooldown_ms;
     const source = typeof input.source === "string" && input.source.trim().length > 0
         ? input.source.trim()
-        : "conductor-supervisor";
+        : "epic-implementer-supervisor";
     const producer = typeof input.producer === "string" && input.producer.trim().length > 0
         ? input.producer.trim()
         : "worker-message-relay";
@@ -1334,7 +1334,7 @@ export async function checkWorkerMessages(input, config = resolveConductorStoreC
                     continue;
                 insertRelayAuditEvent(db, {
                     id: `message.delivered:${row.id}`,
-                    source: "conductor-worker",
+                    source: "epic-implementer-worker",
                     type: "message.delivered",
                     run_id: row.run_id,
                     worker_id: row.worker_id,
@@ -1349,7 +1349,7 @@ export async function checkWorkerMessages(input, config = resolveConductorStoreC
                 toAcked.run({ seq: row.seq });
                 insertRelayAuditEvent(db, {
                     id: `message.acked:${row.id}`,
-                    source: "conductor-worker",
+                    source: "epic-implementer-worker",
                     type: "message.acked",
                     run_id: row.run_id,
                     worker_id: row.worker_id,

package/build/conductor/supervisor-config.js

@@ -65,13 +65,13 @@ const POLL_LIMIT_MAX = 1000;
  * tests/builds.
  */
 export function resolveSupervisorConfig(overrides = {}, env = process.env) {
-    const wake_interval_ms = clampOverride(overrides.wake_interval_ms, parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_WAKE_INTERVAL_MS, WAKE_INTERVAL_DEFAULT_MS, WAKE_INTERVAL_MIN_MS, WAKE_INTERVAL_MAX_MS), WAKE_INTERVAL_MIN_MS, WAKE_INTERVAL_MAX_MS);
-    const global_timeout_ms = clampOverride(overrides.global_timeout_ms, parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_GLOBAL_TIMEOUT_MS, GLOBAL_TIMEOUT_DEFAULT_MS, GLOBAL_TIMEOUT_MIN_MS, GLOBAL_TIMEOUT_MAX_MS), GLOBAL_TIMEOUT_MIN_MS, GLOBAL_TIMEOUT_MAX_MS);
-    const escalation_cooldown_ms = clampOverride(overrides.escalation_cooldown_ms, parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_ESCALATION_COOLDOWN_MS, ESCALATION_COOLDOWN_DEFAULT_MS, ESCALATION_COOLDOWN_MIN_MS, ESCALATION_COOLDOWN_MAX_MS), ESCALATION_COOLDOWN_MIN_MS, ESCALATION_COOLDOWN_MAX_MS);
-    const quiet_after_ms = parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_QUIET_AFTER_MS, QUIET_AFTER_DEFAULT_MS, QUIET_AFTER_MIN_MS, QUIET_AFTER_MAX_MS);
-    const liveness_stalled_after_ms = parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_LIVENESS_STALLED_AFTER_MS, LIVENESS_STALLED_AFTER_DEFAULT_MS, LIVENESS_STALLED_AFTER_MIN_MS, LIVENESS_STALLED_AFTER_MAX_MS);
-    const dead_after_ms = parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_DEAD_AFTER_MS, DEAD_AFTER_DEFAULT_MS, DEAD_AFTER_MIN_MS, DEAD_AFTER_MAX_MS);
-    const poll_limit = parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_SUPERVISOR_POLL_LIMIT, POLL_LIMIT_DEFAULT, POLL_LIMIT_MIN, POLL_LIMIT_MAX);
+    const wake_interval_ms = clampOverride(overrides.wake_interval_ms, parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_WAKE_INTERVAL_MS, WAKE_INTERVAL_DEFAULT_MS, WAKE_INTERVAL_MIN_MS, WAKE_INTERVAL_MAX_MS), WAKE_INTERVAL_MIN_MS, WAKE_INTERVAL_MAX_MS);
+    const global_timeout_ms = clampOverride(overrides.global_timeout_ms, parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_GLOBAL_TIMEOUT_MS, GLOBAL_TIMEOUT_DEFAULT_MS, GLOBAL_TIMEOUT_MIN_MS, GLOBAL_TIMEOUT_MAX_MS), GLOBAL_TIMEOUT_MIN_MS, GLOBAL_TIMEOUT_MAX_MS);
+    const escalation_cooldown_ms = clampOverride(overrides.escalation_cooldown_ms, parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_ESCALATION_COOLDOWN_MS, ESCALATION_COOLDOWN_DEFAULT_MS, ESCALATION_COOLDOWN_MIN_MS, ESCALATION_COOLDOWN_MAX_MS), ESCALATION_COOLDOWN_MIN_MS, ESCALATION_COOLDOWN_MAX_MS);
+    const quiet_after_ms = parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_QUIET_AFTER_MS, QUIET_AFTER_DEFAULT_MS, QUIET_AFTER_MIN_MS, QUIET_AFTER_MAX_MS);
+    const liveness_stalled_after_ms = parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_LIVENESS_STALLED_AFTER_MS, LIVENESS_STALLED_AFTER_DEFAULT_MS, LIVENESS_STALLED_AFTER_MIN_MS, LIVENESS_STALLED_AFTER_MAX_MS);
+    const dead_after_ms = parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_DEAD_AFTER_MS, DEAD_AFTER_DEFAULT_MS, DEAD_AFTER_MIN_MS, DEAD_AFTER_MAX_MS);
+    const poll_limit = parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_SUPERVISOR_POLL_LIMIT, POLL_LIMIT_DEFAULT, POLL_LIMIT_MIN, POLL_LIMIT_MAX);
     return {
         wake_interval_ms,
         global_timeout_ms,
@@ -95,19 +95,19 @@ function clampOverride(override, base, min, max) {
 function resolveStallThresholds(env) {
     return {
         // A worker that never starts should surface quickly.
-        not_started: parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_STALL_NOT_STARTED_MS, 15 * MINUTE_MS, MINUTE_MS, HOUR_MS),
+        not_started: parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_STALL_NOT_STARTED_MS, 15 * MINUTE_MS, MINUTE_MS, HOUR_MS),
         // Active work (tests/builds) is given a long, tolerant budget.
-        active: parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_STALL_ACTIVE_MS, 2 * HOUR_MS, 10 * MINUTE_MS, 12 * HOUR_MS),
+        active: parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_STALL_ACTIVE_MS, 2 * HOUR_MS, 10 * MINUTE_MS, 12 * HOUR_MS),
         // Already-stalled workers re-escalate on a slower cadence.
-        stalled: parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_STALL_STALLED_MS, 30 * MINUTE_MS, 5 * MINUTE_MS, 6 * HOUR_MS),
+        stalled: parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_STALL_STALLED_MS, 30 * MINUTE_MS, 5 * MINUTE_MS, 6 * HOUR_MS),
         // Blocked workers may legitimately wait a long time (human input, deps).
-        blocked: parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_STALL_BLOCKED_MS, 24 * HOUR_MS, 30 * MINUTE_MS, 7 * 24 * HOUR_MS),
+        blocked: parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_STALL_BLOCKED_MS, 24 * HOUR_MS, 30 * MINUTE_MS, 7 * 24 * HOUR_MS),
         // A done candidate that never gets verified should surface.
-        candidate_done: parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_STALL_CANDIDATE_DONE_MS, 30 * MINUTE_MS, 5 * MINUTE_MS, 6 * HOUR_MS),
+        candidate_done: parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_STALL_CANDIDATE_DONE_MS, 30 * MINUTE_MS, 5 * MINUTE_MS, 6 * HOUR_MS),
         // Verification (CI) gets a long, tolerant budget like active work.
-        verifying: parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_STALL_VERIFYING_MS, 2 * HOUR_MS, 10 * MINUTE_MS, 12 * HOUR_MS),
+        verifying: parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_STALL_VERIFYING_MS, 2 * HOUR_MS, 10 * MINUTE_MS, 12 * HOUR_MS),
         // Unknown-state workers surface on a moderate cadence.
-        unknown: parseBoundedSupervisorInt(env.BAPI_CONDUCTOR_STALL_UNKNOWN_MS, 30 * MINUTE_MS, 5 * MINUTE_MS, 6 * HOUR_MS),
+        unknown: parseBoundedSupervisorInt(env.BAPI_EPIC_IMPLEMENTER_STALL_UNKNOWN_MS, 30 * MINUTE_MS, 5 * MINUTE_MS, 6 * HOUR_MS),
         // Terminal states never "stall"; large sentinels keep arithmetic uniform.
         complete: Number.MAX_SAFE_INTEGER,
         failed: Number.MAX_SAFE_INTEGER,