@bridge_gpt/mcp-server 0.2.59 → 0.2.60

package/build/conductor/bridge-api-client.js

@@ -364,8 +364,15 @@ export function safeDiagnosticMessage(err, fallback) {
     }
     return fallback;
 }
-/** GET auth headers. The API key travels ONLY in a header, never in the URL. */
-function conductorGetHeaders(access) {
+/**
+ * GET auth headers. The API key travels ONLY in a header, never in the URL.
+ *
+ * Exported (BAPI-1133) so a caller outside this module — `setup-epic.ts`'s
+ * {@link ConductorBridgeApiAccess}-based adapter for
+ * `resolveMergeExecutionMode`'s narrow dependency shape — can build the same
+ * headers without a second copy of this one-line mapping.
+ */
+export function conductorGetHeaders(access) {
     return { "X-API-Key": access.apiKey };
 }
 /**
@@ -2089,6 +2096,8 @@ export const CONDUCTOR_REVIEW_ALIGNMENT_STATUSES = new Set([
 export const READINESS_FRESH_RECONCILER_COUNT_CAP = 2;
 const READINESS_SOURCES = new Set(["epic", "project_default", "none"]);
 const ACTIONS_LEVELS = new Set(["write", "read", "none", "unknown"]);
+/** The one scope the server reports for the merge-execution block (BAPI-1135). */
+const MERGE_EXECUTION_BRANCH_SCOPES = new Set(["default_branch"]);
 function readinessShapeError() {
     // Deliberately carries NO field name, value, or payload excerpt: a malformed
     // body is untrusted input and its contents must not reach output.
@@ -2240,6 +2249,48 @@ export function parseConductorReadinessResponse(body) {
         conductor_ci_workflow: parseConductorCiWorkflow(root),
         unattended: parseUnattended(root),
         bring_up: parseBringUp(root),
+        merge_execution: parseMergeExecution(root),
+    };
+}
+/**
+ * Parse the optional `merge_execution` block (BAPI-1135).
+ *
+ * Same older-server rule as every optional block above: absent (or null) is
+ * `null`, and a PRESENT block is validated strictly — every boolean through
+ * `requireBool`, the scope through the shared enum parser, and the version as
+ * either `null` or a non-negative integer through `requireInt`.
+ *
+ * A malformed PRESENT block or a malformed present FIELD throws, and is never
+ * degraded to `null`. The distinction is load-bearing: `null` means "this server
+ * does not report it", which is a server-version fact, while a block that claims
+ * to carry merge eligibility and cannot be read is untrusted input. Silently
+ * turning the second into the first would let a corrupt body masquerade as an
+ * older deploy, and the two have different remediations.
+ */
+function parseMergeExecution(body) {
+    const raw = body.merge_execution;
+    if (raw === undefined || raw === null)
+        return null;
+    const o = requireObject(raw);
+    const version = o.merge_workflow_version;
+    let parsedVersion;
+    if (version === null || version === undefined) {
+        parsedVersion = null;
+    }
+    else {
+        parsedVersion = requireInt(o, "merge_workflow_version");
+        if (parsedVersion < 0)
+            throw readinessShapeError();
+    }
+    return {
+        branch_scope: requireEnum(o, "branch_scope", MERGE_EXECUTION_BRANCH_SCOPES),
+        branch_protection_probe_succeeded: requireBool(o, "branch_protection_probe_succeeded"),
+        branch_protection_actions_bot_admitted: requireBool(o, "branch_protection_actions_bot_admitted"),
+        merge_workflow_probe_succeeded: requireBool(o, "merge_workflow_probe_succeeded"),
+        merge_workflow_present: requireBool(o, "merge_workflow_present"),
+        merge_workflow_enabled: requireBool(o, "merge_workflow_enabled"),
+        merge_workflow_version: parsedVersion,
+        merge_workflow_token_write_authority: requireBool(o, "merge_workflow_token_write_authority"),
     };
 }
 /**

package/build/conductor/doctor.js

@@ -13,6 +13,7 @@ import os from "node:os";
 import { doctorConductorLedger } from "./store.js";
 import { detectClaudeLogin, formatClaudeLoginAdvisory } from "../claude-login.js";
 import { inspectConductorGitHooks } from "./git-hooks.js";
+import { MERGE_WORKFLOW_IDENTIFIER } from "./merge-execution-contract.js";
 import { resolveMcpShimInvocationForRuntime, resolvePackageRootFromModuleUrl, } from "../mcp-server-invocation.js";
 import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { resolveProfiles } from "../mcp-profile.js";
@@ -38,13 +39,24 @@ export const MCP_PROFILE_REMEDIATION = "ADD `epic_implementer` to BRIDGE_MCP_PRO
  * is blocked on epic A2 (App elevation to `contents: write`); until A2 ships,
  * `gh` is a real prerequisite and this stays a named check.
  */
-export const GH_CLI_REMEDIATION = "install the GitHub CLI (`gh`) and put it on PATH; conductor-driven merges run under this " +
-    "host's own `gh` auth because the GitHub App token is `contents: read` and cannot merge.";
-/** Remediation for an installed but unauthenticated `gh` (AC-7; see {@link GH_CLI_REMEDIATION}). */
-export const GH_AUTH_REMEDIATION = "run `gh auth login` to grant the conductor merge permission; otherwise local merge emits " +
-    "merge.failed/skip rather than merging.";
-/** Detail used when `gh` authentication was never tested because `gh` is absent. */
-export const GH_AUTH_SKIPPED_DETAIL = "not tested — `gh` is not installed, so `gh auth status` was never run";
+export const GH_CLI_REMEDIATION = "install the GitHub CLI (`gh`) and put it on PATH; conductor-driven merges shell out to it " +
+    "because the GitHub App token is `contents: read` and cannot merge. Since BAPI-1136 `gh` " +
+    "authenticates with the configured merge credential, not with this host's own `gh` login.";
+/**
+ * Remediation for a host with no configured merge credential (BAPI-1136).
+ *
+ * This REPLACED a `gh auth login` remediation, and the replacement is the whole
+ * point. After the merge stopped authenticating as whoever is logged into `gh`,
+ * that instruction sent an operator to fix something the merge no longer reads —
+ * the most expensive kind of wrong hint, because following it looks reasonable
+ * and changes nothing. `merge-pull-request.ts` says exactly that about the same
+ * text; this is the last place it was still live.
+ */
+export const GH_AUTH_REMEDIATION = "set BAPI_LOCAL_MERGE_TOKEN (or BAPI_MACHINE_MERGE_TOKEN for machine-user mode) in the " +
+    "environment this host launches the conductor with; local merge has no ambient-login " +
+    "fallback and fails closed with a named reason when neither is configured.";
+/** Detail used when the credential check was not reached because `gh` is absent. */
+export const GH_AUTH_SKIPPED_DETAIL = "not tested — `gh` is not installed, so no merge could run regardless of credential";
 /**
  * Remediation for a native ledger whose binding does not load.
  *
@@ -422,7 +434,7 @@ export function inspectMcpProfile(env) {
  * `gh auth status` (no writes, no merge) and reports whether the host could merge
  * a PR locally if `policy_json.local_merge.enabled` were set. Never throws.
  */
-export function inspectLocalMerge(runCommand) {
+export function inspectLocalMerge(runCommand, env = process.env) {
     const run = runCommand ??
         ((cmd, args) => {
             try {
@@ -447,48 +459,51 @@ export function inspectLocalMerge(runCommand) {
             }
         });
     let gh_available = false;
-    let gh_authed = false;
     try {
         gh_available = run("gh", ["--version"]).status === 0;
     }
     catch {
         gh_available = false;
     }
-    if (gh_available) {
-        try {
-            gh_authed = run("gh", ["auth", "status"]).status === 0;
-        }
-        catch {
-            gh_authed = false;
-        }
-    }
+    // BAPI-1136. This used to run `gh auth status` and call the result
+    // `gh_authed`. That probe measured the ambient session, which the merge stopped
+    // consulting — so it reported PASS on a host with a logged-in `gh` and no
+    // configured credential (every merge then failing
+    // `local_merge_credential_missing`), and WARN on a host with the credential set
+    // and no ambient login (where merges work). Both directions wrong.
+    //
+    // The replacement asks the question the merge actually asks, and answers it
+    // read-only from the environment — no subprocess, no network, and no credential
+    // VALUE anywhere in the result. Either mode's key satisfies it: which one a run
+    // uses is the server-resolved typed mode, which a local doctor cannot know.
+    const merge_credential_configured = ["BAPI_LOCAL_MERGE_TOKEN", "BAPI_MACHINE_MERGE_TOKEN"].some((key) => typeof env[key] === "string" && env[key].trim().length > 0);
     const warnings = [];
     if (!gh_available) {
         warnings.push("`gh` is not installed or not on PATH. Local merge (policy_json.local_merge.enabled) " +
             "cannot run; install the GitHub CLI to enable conductor-driven merges.");
     }
-    else if (!gh_authed) {
-        warnings.push("`gh` is installed but not authenticated (`gh auth status` failed). Run `gh auth login` " +
-            "to grant the conductor merge permission; otherwise local merge will emit merge.failed/skip.");
-    }
-    // Capability gap only — local merge is opt-in, so an unauthed host is not a hard
-    // failure unless the operator enabled it. Reported as degraded for visibility.
-    const degraded = !gh_available || !gh_authed;
-    // TWO outcomes, not one (BAPI-1055): installing `gh` and running `gh auth
-    // login` are independently actionable, and `degraded` below is deliberately
-    // left as the SAME `!gh_available || !gh_authed` conjunction it has always
-    // been. When `gh` is absent the auth outcome is `skip`, never `fail` — the
-    // authentication was never tested, and claiming it failed would send the
-    // operator to `gh auth login` on a host with no `gh`.
+    else if (!merge_credential_configured) {
+        warnings.push("`gh` is installed but no merge credential is configured. Set BAPI_LOCAL_MERGE_TOKEN " +
+            "(or BAPI_MACHINE_MERGE_TOKEN for machine-user mode); local merge has no ambient-login " +
+            "fallback and fails closed with a named reason.");
+    }
+    // Capability gap only — local merge is opt-in, so an unconfigured host is not a
+    // hard failure unless the operator enabled it. Reported as degraded for visibility.
+    const degraded = !gh_available || !merge_credential_configured;
+    // TWO outcomes, not one (BAPI-1055): installing `gh` and configuring the merge
+    // credential are independently actionable, and `degraded` stays the same
+    // `!gh_available || !<second check>` conjunction it has always been. When `gh`
+    // is absent the second outcome is `skip`, never `fail` — nothing could merge on
+    // that host regardless of credential, so reporting a credential failure would
+    // name the wrong fix.
     //
-    // AC-7 — these two checks are LOAD-BEARING and must not be retired here.
-    // Conductor merges run under this machine's own `gh` auth because the GitHub
-    // App token is `contents: read` and structurally cannot merge; see
-    // `mcp_server/src/executor/merge-job.ts` and the `contents: read` constraint
-    // documented in `mcp_server/src/merge-pull-request.ts`. Retirement is owned by
-    // epic A2, after the App is elevated to `contents: write`. Nothing in this
-    // change removes, hides, or downgrades either check, and no merge behaviour is
-    // altered by reporting them.
+    // AC-7 RETIRED HERE (BAPI-1136). The note this replaces said these checks were
+    // load-bearing because "conductor merges run under this machine's own `gh`
+    // auth", and named epic A2 as the owner of their retirement. This IS that A2
+    // child: the merge now authenticates with one explicitly configured,
+    // customer-held credential and never with the ambient session. So the check is
+    // not removed — it is re-pointed at the thing that now decides, which is the
+    // only way it stays load-bearing rather than becoming decorative.
     const outcomes = [
         gh_available
             ? {
@@ -506,28 +521,155 @@ export function inspectLocalMerge(runCommand) {
             },
         !gh_available
             ? {
-                id: "gh-auth",
-                label: "GitHub CLI authentication",
+                id: "merge-credential",
+                label: "Configured merge credential",
                 status: "skip",
                 detail: GH_AUTH_SKIPPED_DETAIL,
                 remediation: GH_CLI_REMEDIATION,
             }
-            : gh_authed
+            : merge_credential_configured
                 ? {
-                    id: "gh-auth",
-                    label: "GitHub CLI authentication",
+                    id: "merge-credential",
+                    label: "Configured merge credential",
                     status: "pass",
-                    detail: "`gh auth status` reports an authenticated account",
+                    detail: "BAPI_LOCAL_MERGE_TOKEN or BAPI_MACHINE_MERGE_TOKEN is set",
                 }
                 : {
-                    id: "gh-auth",
-                    label: "GitHub CLI authentication",
+                    id: "merge-credential",
+                    label: "Configured merge credential",
                     status: "warn",
-                    detail: "`gh` is installed but `gh auth status` failed",
+                    detail: "`gh` is installed but neither BAPI_LOCAL_MERGE_TOKEN nor " +
+                        "BAPI_MACHINE_MERGE_TOKEN is set, so a local merge would fail closed",
                     remediation: GH_AUTH_REMEDIATION,
                 },
     ];
-    return { gh_available, gh_authed, degraded, warnings, outcomes };
+    return { gh_available, merge_credential_configured, degraded, warnings, outcomes };
+}
+/** Remediation when this host has no `gh` identity to observe with. */
+export const GH_ACTIONS_MERGE_AUTH_REMEDIATION = "run `gh auth login` so this host has a GitHub identity; without one it cannot " +
+    "observe the merge capability. This does not affect whether the capability exists.";
+/** Remediation when the capability could not be observed from this host. */
+export const GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION = "check network connectivity to api.github.com and `gh auth status`; the merge " +
+    "capability could NOT BE OBSERVED from this host, which is not the same as it " +
+    "being absent. The server's conductor readiness report is authoritative.";
+/** Detail for the observability outcome when the auth prerequisite never held. */
+export const GH_ACTIONS_MERGE_SKIPPED_DETAIL = "not attempted — this host has no authenticated `gh` identity";
+/**
+ * Read-only probe of whether this host can observe the `github_actions` merge
+ * capability. Never throws.
+ *
+ * Two bounded, read-only commands and nothing else: `gh auth status`, then a
+ * status-only `gh api` GET of the canonical workflow metadata endpoint. The
+ * injected runner returns a STATUS ONLY — it is deliberately not widened to
+ * capture stdout, because parsing that output would mean re-deriving workflow
+ * state the server already reports, from a different identity, with no way to
+ * reconcile a disagreement.
+ *
+ * Every failure mode — a timeout, a non-zero status, a missing `gh`, a thrown
+ * dependency error — degrades to `false` with a retry-oriented warning. None
+ * raises a backend platform alert: an unobservable capability is a LOCAL
+ * condition, and paging on it would page for every laptop behind a proxy.
+ *
+ * Emits only status classifications and fixed remediation text. No process
+ * output, auth detail, repository URL, or command credential appears anywhere in
+ * the result.
+ */
+export function inspectGitHubActionsMerge(runCommand) {
+    const run = runCommand ??
+        ((cmd, args) => {
+            try {
+                // Same structure and bound as `inspectLocalMerge`: a static ESM import,
+                // a 10s timeout so a network stall cannot hold the doctor past it, and
+                // GH_PROMPT_DISABLED so an interactive prompt cannot either.
+                const r = spawnSync(cmd, args, {
+                    encoding: "utf8",
+                    timeout: 10_000,
+                    env: { ...process.env, GH_PROMPT_DISABLED: "1" },
+                });
+                return { status: r.status };
+            }
+            catch {
+                return { status: null };
+            }
+        });
+    let gh_authed = false;
+    try {
+        gh_authed = run("gh", ["auth", "status"]).status === 0;
+    }
+    catch {
+        gh_authed = false;
+    }
+    let capability_observable = false;
+    if (gh_authed) {
+        try {
+            // `--silent` keeps the body out of the child's stdout entirely: this probe
+            // wants the STATUS, and a body it never requests is a body it cannot leak.
+            capability_observable =
+                run("gh", [
+                    "api",
+                    "--silent",
+                    `repos/{owner}/{repo}/actions/workflows/${MERGE_WORKFLOW_IDENTIFIER}`,
+                ]).status === 0;
+        }
+        catch {
+            capability_observable = false;
+        }
+    }
+    const warnings = [];
+    if (!gh_authed) {
+        warnings.push(GH_ACTIONS_MERGE_AUTH_REMEDIATION);
+    }
+    else if (!capability_observable) {
+        warnings.push(GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION);
+    }
+    const outcomes = [
+        gh_authed
+            ? {
+                id: "gh-actions-merge-auth",
+                label: "GitHub Actions merge: local observation prerequisites",
+                status: "pass",
+                detail: "eligible to observe — `gh auth status` reports an authenticated account",
+            }
+            : {
+                id: "gh-actions-merge-auth",
+                label: "GitHub Actions merge: local observation prerequisites",
+                status: "warn",
+                detail: "not observable — no authenticated `gh` identity on this host",
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            },
+        !gh_authed
+            ? {
+                // `skip`, never `fail`: observability was never tested, and claiming it
+                // failed would send the operator to debug connectivity on a host that
+                // simply has no identity yet.
+                id: "gh-actions-merge-observable",
+                label: "GitHub Actions merge: capability observability",
+                status: "skip",
+                detail: GH_ACTIONS_MERGE_SKIPPED_DETAIL,
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            }
+            : capability_observable
+                ? {
+                    id: "gh-actions-merge-observable",
+                    label: "GitHub Actions merge: capability observability",
+                    status: "pass",
+                    detail: "eligible to observe — the workflow metadata endpoint answered",
+                }
+                : {
+                    id: "gh-actions-merge-observable",
+                    label: "GitHub Actions merge: capability observability",
+                    status: "warn",
+                    detail: "could not verify — the workflow metadata endpoint could not be read",
+                    remediation: GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION,
+                },
+    ];
+    return {
+        gh_authed,
+        capability_observable,
+        degraded: !gh_authed || !capability_observable,
+        warnings,
+        outcomes,
+    };
 }
 /**
  * Build the combined read-only doctor report. Composes the existing ledger
@@ -553,12 +695,43 @@ export async function buildConductorDoctorReport(deps = {}) {
         git_hooks: inspectHooks(deps.hooksDeps),
         mcp_profile,
         local_merge: inspectLocalMerge(deps.runCommand),
+        github_actions_merge: inspectGitHubActionsMergeSafe(deps),
         native_ledger,
         deny_enforcement,
         claude_login,
         repair_credentials: await inspectRepairVerbCredentials(deps.env ?? process.env, deps.resolveRepairAccess),
     };
 }
+/**
+ * Run the GitHub Actions merge inspector, containing any throw as degraded data.
+ *
+ * The production inspector is already exception-safe; this is defense in depth
+ * for an INJECTED fake, so a test double that throws degrades the section rather
+ * than failing the whole doctor report.
+ */
+function inspectGitHubActionsMergeSafe(deps) {
+    const inspect = deps.inspectGitHubActionsMerge ?? inspectGitHubActionsMerge;
+    try {
+        return inspect(deps.runCommand);
+    }
+    catch {
+        return {
+            gh_authed: false,
+            capability_observable: false,
+            degraded: true,
+            warnings: [GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION],
+            outcomes: [
+                {
+                    id: "gh-actions-merge-observable",
+                    label: "GitHub Actions merge: capability observability",
+                    status: "warn",
+                    detail: "could not verify — the local inspection could not be completed",
+                    remediation: GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION,
+                },
+            ],
+        };
+    }
+}
 /**
  * Run the deny-enforcement inspector and convert any thrown exception into degraded
  * report data — a deny-probe failure must never throw out of doctor. The underlying
@@ -598,7 +771,7 @@ async function inspectDenyEnforcementSafe(inspect) {
  * hierarchy across sections.
  */
 export function formatConductorDoctorReport(report) {
-    const { ledger, git_hooks, mcp_profile, local_merge, native_ledger, deny_enforcement, claude_login } = report;
+    const { ledger, git_hooks, mcp_profile, local_merge, github_actions_merge, native_ledger, deny_enforcement, claude_login } = report;
     const lines = [
         "Conductor ledger doctor",
         "───────────────────────",
@@ -666,13 +839,38 @@ export function formatConductorDoctorReport(report) {
     lines.push("Local merge capability (optional, opt-in)");
     lines.push("─────────────────────────────────────────");
     const ghTag = local_merge.gh_available
-        ? local_merge.gh_authed
+        ? local_merge.merge_credential_configured
             ? "[OK]"
-            : "[WARNING] not authenticated"
+            : "[WARNING] no merge credential configured"
         : "[WARNING] not installed";
     lines.push(`gh available:          ${local_merge.gh_available} ${ghTag}`);
-    lines.push(`gh authenticated:      ${local_merge.gh_authed}`);
+    lines.push(`merge credential set:  ${local_merge.merge_credential_configured}`);
     lines.push(`degraded:              ${local_merge.degraded}`);
+    // BAPI-1135 — the two observations render INDEPENDENTLY, each leading with its
+    // own decisive word, because they have two different fixes. Collapsing them
+    // into one line would hide which of the two an operator has to act on.
+    //
+    // The vocabulary is deliberate: `not observable` is a statement about THIS
+    // HOST, and `could not verify` is a statement about a read that failed.
+    // Neither ever says the capability is absent — only the server's readiness
+    // report may say that.
+    if (github_actions_merge) {
+        lines.push("");
+        lines.push("GitHub Actions merge (read-only observability)");
+        lines.push(`gh authenticated:      ${github_actions_merge.gh_authed} ${github_actions_merge.gh_authed ? "(eligible to observe)" : "(not observable)"}`);
+        lines.push(`capability observable: ${github_actions_merge.capability_observable} ${github_actions_merge.gh_authed
+            ? github_actions_merge.capability_observable
+                ? "(eligible to observe)"
+                : "(could not verify)"
+            : "(not attempted)"}`);
+        lines.push(`degraded:              ${github_actions_merge.degraded}`);
+        if (github_actions_merge.warnings.length > 0) {
+            lines.push("warnings:");
+            for (const w of github_actions_merge.warnings)
+                lines.push(`  - ${w}`);
+        }
+        lines.push("");
+    }
     if (local_merge.warnings.length > 0) {
         lines.push("local merge warnings:");
         for (const w of local_merge.warnings)
@@ -753,7 +951,7 @@ export const CONDUCTOR_READINESS_DESCRIPTORS = [
     { id: "git-hooks", label: "Conductor git hooks" },
     { id: "mcp-profile", label: "Epic Implementer MCP profile" },
     { id: "gh-cli", label: "GitHub CLI availability" },
-    { id: "gh-auth", label: "GitHub CLI authentication" },
+    { id: "merge-credential", label: "Configured merge credential" },
     { id: "native-ledger", label: "Native ledger binding" },
     { id: "mcp-registration-form", label: "Worker MCP registration form" },
     { id: "node-engine", label: "Expected Node engine" },
@@ -921,6 +1119,10 @@ export function mapConductorDoctorReportToReadinessChecks(report) {
         record(outcome);
     for (const outcome of outcomesOf(report?.local_merge))
         record(outcome);
+    // BAPI-1135 — both observability outcomes flow through the same readiness-check
+    // mapping as every other doctor outcome, so no surface formats them twice.
+    for (const outcome of outcomesOf(report?.github_actions_merge))
+        record(outcome);
     for (const outcome of outcomesOf(report?.native_ledger))
         record(outcome);
     record(denyEnforcementOutcome(report));

package/build/conductor/epic-runtime.js

@@ -23,7 +23,7 @@ import { processGateMetMerge } from "./supervisor-merge.js";
 import { observePrCiOnce } from "./pr-ci-producer.js";
 import { runGhCommand } from "./pr-discovery.js";
 import { isPrMergeConflict, parseGhPrMergeabilityFields, } from "./github-mergeability.js";
-import { makeLocalMergeExecutor, resolveLocalMergeMethod } from "./local-merge.js";
+import { makeLocalMergeExecutor, resolveLocalMergeCredential, resolveLocalMergeMethod, } from "./local-merge.js";
 import { getHeadSha, getPrNumber } from "./event-accessors.js";
 import { emitConductorEventIfNew } from "./producer-ledger.js";
 import { rebuildObservedState, extractWorkerLiveness, } from "./epic-state.js";
@@ -1320,7 +1320,16 @@ export async function runEpicTick(options, deps = {}) {
                                 merge: makeLocalMergeExecutor({
                                     method: resolveLocalMergeMethod(localCfg.method),
                                     approvalRequired: localCfg.approval_required === true,
-                                }, { env: process.env }),
+                                }, 
+                                // BAPI-1136: `env` now supplies only the allowlisted
+                                // operational base; the identity is the explicitly configured
+                                // local credential, and an unconfigured one fails closed with
+                                // `local_merge_credential_missing` rather than borrowing the
+                                // ambient `gh` login this path used to rely on.
+                                {
+                                    env: process.env,
+                                    credential: resolveLocalMergeCredential(process.env, "local"),
+                                }),
                                 // BAPI-525 Change A: durable attribution for a worker_id-less gate.met.
                                 resolveWorkerIdForGateEvent,
                             });

package/build/conductor/install-doctor.js

@@ -36,7 +36,7 @@ import { buildConductorDoctorReport, formatConductorDoctorReport, } from "./doct
 import { inspectBridgeApiProfileToken, } from "../mcp-host-config.js";
 import { collectExecutorServiceDiagnostics, formatExecutorServiceDiagnosticsReport, } from "../doctor.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, } from "../install-doctor.js";
-import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, conductorProfileTokenSection, EPIC_IMPLEMENTER_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
+import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, gitHubActionsMergeObservabilitySections, conductorProfileTokenSection, EPIC_IMPLEMENTER_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, mergeExecutionSections, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
 import { ConductorBridgeApiError, fetchConductorReadiness, } from "./bridge-api-client.js";
 /**
  * Run one optional collector, containing any throw.
@@ -157,6 +157,13 @@ export async function runConductorInstallDoctor(deps) {
         sections.push(...supervisorSection(readiness));
         sections.push(githubCredentialsSection(readiness));
         sections.push(githubActionsSection(readiness));
+        // BAPI-1135 — the shared "Merge execution eligibility" section, immediately
+        // after the App permission row it is most often confused with, so the two
+        // write facts are read side by side. Built by `readiness-sections.ts` rather
+        // than formatted here, so this installer and the advisory gate render one
+        // classification; the installer's `settle`-based degraded isolation is
+        // unchanged, and no row here is `fatal`.
+        sections.push(...mergeExecutionSections(readiness));
     }
     const workflow = await inspectWorkflowPresence(deps.readWorkflowFile, deps.classifyWorkflowDrift);
     sections.push(workflowSection(workflow.presence, deps.reviewPolicySource, workflow.driftDetail));
@@ -230,6 +237,13 @@ export async function runConductorInstallDoctor(deps) {
     sections.push(conductorProfileTokenSection(profileToken, conductorContext));
     sections.push(conductorHookTargetsSection(legacyConductor, conductorContext));
     sections.push(conductorLedgerLoadabilitySection(legacyConductor));
+    // BAPI-1135 — this HOST's ability to observe the merge capability, beside the
+    // other locally-derived doctor rows. Distinct from the server-fact
+    // "Merge execution eligibility" section pushed above: that one says whether
+    // the repository can merge, these two say whether this machine can look.
+    // `settle`-based degraded isolation is unchanged — a doctor that failed to
+    // collect yields two explicit unknown rows, never an omitted section.
+    sections.push(...gitHubActionsMergeObservabilitySections(legacyConductor));
     return {
         legacyConductor,
         legacyExecutorPreflight,
@@ -335,6 +349,14 @@ export function conductorInstallDoctorHasFatal(report) {
 // remediation constants, or the installer reporting APIs from
 // `conductor/install-doctor.js` keeps resolving exactly as before.
 // ---------------------------------------------------------------------------
-export { BRING_UP_SECTION_LABELS, bringUpSafetySections, databaseMigrationCurrentSection, singleTransitionAuthoritySection, workerPresentSection, CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, EPIC_IMPLEMENTER_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, } from "./readiness-sections.js";
+export { BRING_UP_SECTION_LABELS, bringUpSafetySections, 
+// BAPI-1135 — re-exported on the compatibility surface like every other
+// section builder, so an existing importer of this module sees the new
+// section without learning a second import path.
+mergeExecutionSections, databaseMigrationCurrentSection, singleTransitionAuthoritySection, workerPresentSection, CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, EPIC_IMPLEMENTER_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, 
+// BAPI-1135 — both new section builders join the compatibility surface like
+// every other one, so an existing importer of this module does not learn a
+// second import path for them.
+gitHubActionsMergeObservabilitySections, } from "./readiness-sections.js";
 // BAPI-1153 — the bring-up remediations the three sections above render.
 export { BRING_UP_RUNBOOK, BRING_UP_UNREPORTED_REMEDIATION, DATABASE_MIGRATION_BEHIND_REMEDIATION, DATABASE_MIGRATION_UNREADABLE_REMEDIATION, SECOND_RECONCILER_REMEDIATION, WORKER_HEARTBEAT_UNREADABLE_REMEDIATION, WORKER_NOT_PRESENT_REMEDIATION, } from "./bring-up-facts.js";