@bridge_gpt/mcp-server 0.2.59 → 0.2.62

package/build/conductor/readiness-sections.js

@@ -36,7 +36,9 @@
 import { MANAGED_HOOK_NAMES } from "./git-hooks.js";
 import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { CLAUDE_REVIEW_WORKFLOW_DRIFT_REMEDIATION, summarizeClaudeReviewWorkflowDrift, } from "../claude-review-workflow-drift.js";
-import { describeNativeLedgerAvailability } from "./doctor.js";
+import { describeNativeLedgerAvailability, GH_ACTIONS_MERGE_AUTH_REMEDIATION, GH_ACTIONS_MERGE_SKIPPED_DETAIL, GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION, } from "./doctor.js";
+import { classifyMergeExecutionEligibility, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
+import { MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS, MERGE_WORKFLOW_PATH, mergeWorkflowVersionSupportsChildMerge, } from "./merge-execution-contract.js";
 import { classifyDatabaseMigration, classifySingleTransitionAuthority, classifyWorkerPresent, } from "./bring-up-facts.js";
 /** Operator runbook pointer surfaced beside the executor gap. */
 export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-implementer-v2-operator-runbook.md";
@@ -71,13 +73,95 @@ export const CONDUCTOR_HOOK_TARGET_REMEDIATION = "re-run `install conductor` and
 export const CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION = "`better-sqlite3` is an optionalDependency npm silently skips on a build failure — " +
     "reinstall it for this Node runtime to restore local conductor observability.";
 /** Remediation surfaced whenever no healthy generated service unit is detected. */
-export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `install conductor --executor-id <id>` or " +
+export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `install conductor --executor-id <id> --repo-wide` or " +
     "`executor install-service` (or run the executor by hand) — " +
     `see ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`;
 /** Remediation for a unit that exists but whose service is not running. */
 export const EXECUTOR_SERVICE_START_REMEDIATION = "start the service (re-run `install conductor` and accept the start consent, or run the " +
     `printed launchctl/systemctl command by hand) — see ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`;
 // ---------------------------------------------------------------------------
+// BAPI-1254 — the ONE required-check presentation
+// ---------------------------------------------------------------------------
+/**
+ * Operator-hold sentence shared by every non-verified outcome. It states what an
+ * operator must do; it does not claim this report blocks anything — activation
+ * and dispatch enforcement belong to a separate slice.
+ */
+const REQUIRED_CHECKS_OPERATOR_HOLD = "hold new unattended epic work until this is resolved";
+/** Fixed, secret-free copy for each outcome. Names no check, branch, or SHA. */
+export const REQUIRED_CHECKS_PRESENTATION_COPY = {
+    verified: {
+        detail: "Verified — every configured required check is produced by the lane workflows",
+    },
+    unknown_name: {
+        detail: "Configuration mismatch confirmed — a configured required check conflicts with the " +
+            `current lane producer contract; ${REQUIRED_CHECKS_OPERATOR_HOLD}`,
+        remediation: "repair the project-default required-check configuration so it names the check the " +
+            "lane workflow emits (see the operator runbook's patch-policy section for active runs).",
+    },
+    unverifiable: {
+        detail: "Could not verify — the configured required checks could not be matched to an " +
+            `authoritative producer; ${REQUIRED_CHECKS_OPERATOR_HOLD}`,
+        remediation: "restore required-check verification (a readable default branch with static lane " +
+            "workflows and a current Bridge API), or correct the required-check configuration.",
+    },
+    empty: {
+        detail: "Could not verify — the required-check list is EMPTY, which is unsafe: the done gate " +
+            `would pass unconditionally; ${REQUIRED_CHECKS_OPERATOR_HOLD}`,
+        remediation: "configure a non-empty required-check list naming the checks the lane workflows emit.",
+    },
+    olderServer: {
+        detail: "Could not verify — this Bridge API does not report required-check verification; " +
+            REQUIRED_CHECKS_OPERATOR_HOLD,
+        remediation: "upgrade the Bridge API deploy so it verifies required checks, or correct the " +
+            "required-check configuration; its state is unknown here, not healthy.",
+    },
+};
+/**
+ * Map the validated supervisor facts onto one required-check presentation.
+ *
+ * PURE, and the only place either renderer decides this row: the CLI descriptor
+ * and the install-time section both call it, so they cannot drift and neither
+ * performs a second producer verification. Only the server's `verified` verdict
+ * is satisfied. A nonempty count is never proof, an older server's absent group
+ * is `unverifiable`, and an empty list stays unsafe whatever else is reported.
+ * No remediation suggests disabling required checks.
+ */
+export function presentRequiredChecks(supervisor) {
+    const verdict = supervisor.required_checks_verification ?? null;
+    if (supervisor.required_checks_empty) {
+        return { outcome: "unverifiable", satisfied: false, ...REQUIRED_CHECKS_PRESENTATION_COPY.empty };
+    }
+    if (verdict === null) {
+        return {
+            outcome: "unverifiable",
+            satisfied: false,
+            ...REQUIRED_CHECKS_PRESENTATION_COPY.olderServer,
+        };
+    }
+    if (verdict === "verified") {
+        const fresh = supervisor.required_checks_evidence_fresh === true ? ", fresh evidence" : "";
+        return {
+            outcome: "verified",
+            satisfied: true,
+            detail: `${REQUIRED_CHECKS_PRESENTATION_COPY.verified.detail} ` +
+                `(${supervisor.required_checks_count} required check(s) configured${fresh})`,
+        };
+    }
+    if (verdict === "unknown_name") {
+        return {
+            outcome: "unknown_name",
+            satisfied: false,
+            ...REQUIRED_CHECKS_PRESENTATION_COPY.unknown_name,
+        };
+    }
+    return {
+        outcome: "unverifiable",
+        satisfied: false,
+        ...REQUIRED_CHECKS_PRESENTATION_COPY.unverifiable,
+    };
+}
+// ---------------------------------------------------------------------------
 // Section builders
 // ---------------------------------------------------------------------------
 export function supervisorSection(readiness) {
@@ -107,20 +191,20 @@ export function supervisorSection(readiness) {
     // Deliberately its OWN section, not folded into the one above: "configured but
     // unsafe" and "not configured" drive different operator actions, and an empty
     // required-check list makes the CI gate pass unconditionally rather than fail.
-    sections.push(s.required_checks_empty
-        ? {
-            id: "supervisor-required-checks",
-            label: "Supervisor required CI checks",
-            status: "degraded",
-            detail: "required-check list is EMPTY — the done gate would pass unconditionally",
-            remediation: "bootstrap writes a non-empty required-check list into done_gate_config.",
-        }
-        : {
-            id: "supervisor-required-checks",
-            label: "Supervisor required CI checks",
-            status: "ok",
-            detail: `${s.required_checks_count} required check(s) configured`,
-        });
+    //
+    // BAPI-1254: the verdict comes from the shared `presentRequiredChecks`, the
+    // same mapping the CLI descriptor uses. Only `verified` is `ok`; a confirmed
+    // mismatch and could-not-verify are both `degraded`, never `fatal`.
+    const requiredChecks = presentRequiredChecks(s);
+    sections.push({
+        id: "supervisor-required-checks",
+        label: "Supervisor required CI checks",
+        status: requiredChecks.satisfied ? "ok" : "degraded",
+        detail: requiredChecks.detail,
+        ...(requiredChecks.remediation === undefined
+            ? {}
+            : { remediation: requiredChecks.remediation }),
+    });
     // BAPI-694 (R5) — its OWN section, and WARN-ONLY.
     //
     // `degraded`, never `fatal`: a divergence between the code_review gate's
@@ -216,6 +300,95 @@ export function githubActionsSection(readiness) {
         remediation: "grant the GitHub App `actions: write`; the conductor's workflow rerun lane fails open on 403 without it.",
     };
 }
+/**
+ * The "Merge execution eligibility" section (BAPI-1135).
+ *
+ * A DEDICATED section rather than extra rows on the GitHub App block, because it
+ * is a different safety diagnostic about a different principal: the App block
+ * describes the installation's dispatch permission, this one describes whether
+ * the repository's merge workflow can actually merge.
+ *
+ * Rows are rendered in DEPENDENCY order — probe/readability, presence, enabled
+ * state, exact version, App `actions: write`, workflow-token write authority,
+ * branch-policy admission — so a reader meets the fact that decided the verdict
+ * before the facts that were never reached.
+ *
+ * Three rendering rules this section holds to:
+ *
+ * * an absent older-server block and a failed probe are explicit UNKNOWN rows,
+ *   never an omitted section and never a pass. "Not reported" is not "healthy";
+ *   omitting the section would make an unknown look like a clean bill of health.
+ * * confirmed policy denial stays verbally distinct from unreadability. The
+ *   status word (`degraded` for unknown, `fatal`-adjacent `degraded` with
+ *   different copy for confirmed) is carried in TEXT, not by colour alone, and
+ *   the detail line opens with `could not verify:` or `not eligible:`.
+ * * command strings, workflow paths, versions, and reason codes are rendered as
+ *   backticked monospace through the established section conventions, and are
+ *   allowed to wrap rather than being truncated — a truncated remedy command is
+ *   not a remedy.
+ */
+export function mergeExecutionSections(readiness) {
+    const verdict = classifyMergeExecutionEligibility(readiness);
+    const m = readiness.merge_execution;
+    if (m === null || m === undefined) {
+        // One row, not seven. Fabricating six more unknown rows from a block that
+        // was never reported would imply the server answered six questions.
+        return [
+            {
+                id: "merge-execution-eligibility",
+                label: "Merge execution eligibility",
+                status: "degraded",
+                detail: `could not verify: ${verdict.detail}`,
+                remediation: verdict.remediation ?? MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION,
+            },
+        ];
+    }
+    const decisive = {
+        id: "merge-execution-eligibility",
+        label: "Merge execution eligibility",
+        status: verdict.status === "eligible" ? "ok" : "degraded",
+        detail: verdict.status === "eligible"
+            ? `eligible: ${verdict.detail}`
+            : verdict.status === "could_not_verify"
+                ? `could not verify: ${verdict.detail}`
+                : `not eligible: ${verdict.detail} (\`${verdict.reason}\`)`,
+        ...(verdict.remediation ? { remediation: verdict.remediation } : {}),
+    };
+    // The supporting facts, in dependency order. Each is a plain readable row — no
+    // remediation of its own, because the decisive row above already names the one
+    // action, and repeating it seven times would bury it.
+    const fact = (id, label, ok, detail) => ({
+        id,
+        label,
+        status: ok ? "ok" : "degraded",
+        detail,
+    });
+    return [
+        decisive,
+        fact("merge-execution-branch-policy-readable", "Branch policy readable", m.branch_protection_probe_succeeded, m.branch_protection_probe_succeeded
+            ? `read on the ${m.branch_scope.replace("_", " ")}`
+            : "could not verify: the branch policy could not be read"),
+        fact("merge-execution-workflow-present", "Merge workflow present", m.merge_workflow_probe_succeeded && m.merge_workflow_present, !m.merge_workflow_probe_succeeded
+            ? "could not verify: the workflow metadata could not be read"
+            : m.merge_workflow_present
+                ? `\`${MERGE_WORKFLOW_PATH}\` present`
+                : `not eligible: \`${MERGE_WORKFLOW_PATH}\` is absent`),
+        fact("merge-execution-workflow-enabled", "Merge workflow enabled", m.merge_workflow_enabled, m.merge_workflow_enabled ? "enabled" : "not eligible: disabled or unknown"),
+        fact("merge-execution-workflow-version", "Merge workflow version", mergeWorkflowVersionSupportsChildMerge(m.merge_workflow_version), `\`${m.merge_workflow_version ?? "unset"}\` (expected one of ` +
+            `\`${MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS.join(", ")}\`)`),
+        fact("merge-execution-app-actions-write", "GitHub App `actions: write`", readiness.github.actions_write, readiness.github.actions_probe_succeeded
+            ? `actions: \`${readiness.github.actions_permission_level}\``
+            : "could not verify: the App permission could not be checked"),
+        fact("merge-execution-workflow-token-write", "Workflow token write authority", m.merge_workflow_token_write_authority, m.merge_workflow_token_write_authority
+            ? "the merge workflow's own token holds write authority"
+            : "not eligible: the merge workflow's own token does not hold write authority"),
+        fact("merge-execution-actor-admitted", "Branch policy admits the workflow actor", m.branch_protection_actions_bot_admitted, m.branch_protection_probe_succeeded
+            ? m.branch_protection_actions_bot_admitted
+                ? "admitted"
+                : "not eligible: the workflow actor is excluded"
+            : "could not verify: the branch policy could not be read"),
+    ];
+}
 export function reconcilerSection(readiness) {
     const r = readiness.reconciler;
     if (!r.liveness_readable) {
@@ -630,6 +803,73 @@ export function conductorHookTargetsSection(legacyConductor, conductorContext) {
  * sanitized failure kind, because the common cause is npm silently skipping an
  * optionalDependency build and that is undiagnosable without the ABI.
  */
+/**
+ * Project the doctor's read-only `github_actions` merge OBSERVABILITY inspection
+ * into this layer's sections (BAPI-1135).
+ *
+ * Projected here rather than formatted inside installation code, for the same
+ * reason every other doctor fact is: the install-time doctor and the advisory
+ * readiness gate must render one classification, and a second formatter in the
+ * installer is how the two come to describe the same probe differently.
+ *
+ * Two sections, never one. `gh` authentication and endpoint reachability are
+ * independently actionable, and a collapsed row would hide which of the two the
+ * operator has to fix.
+ *
+ * These describe THIS HOST's ability to observe — never whether the capability
+ * is sufficient. {@link mergeExecutionSections} owns that, from the server's own
+ * report. The wording keeps them apart deliberately: `not observable` and `could
+ * not verify` here, versus `not eligible` there.
+ */
+export function gitHubActionsMergeObservabilitySections(legacyConductor) {
+    const authBase = {
+        id: "gh-actions-merge-auth",
+        label: "GitHub Actions merge: local observation prerequisites",
+    };
+    const observeBase = {
+        id: "gh-actions-merge-observable",
+        label: "GitHub Actions merge: capability observability",
+    };
+    const inspection = legacyConductor?.github_actions_merge;
+    if (inspection === undefined || inspection === null) {
+        // The doctor was not collected, or predates this inspection. Both rows say
+        // so rather than being omitted — an absent row reads as "fine".
+        const detail = "could not verify — the epic-implementer doctor reported no observation";
+        return [
+            { ...authBase, status: "degraded", detail },
+            { ...observeBase, status: "degraded", detail },
+        ];
+    }
+    return [
+        inspection.gh_authed
+            ? { ...authBase, status: "ok", detail: "eligible to observe — `gh` is authenticated" }
+            : {
+                ...authBase,
+                status: "degraded",
+                detail: "not observable — no authenticated `gh` identity on this host",
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            },
+        !inspection.gh_authed
+            ? {
+                ...observeBase,
+                status: "degraded",
+                detail: GH_ACTIONS_MERGE_SKIPPED_DETAIL,
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            }
+            : inspection.capability_observable
+                ? {
+                    ...observeBase,
+                    status: "ok",
+                    detail: "eligible to observe — the workflow metadata endpoint answered",
+                }
+                : {
+                    ...observeBase,
+                    status: "degraded",
+                    detail: "could not verify — the workflow metadata endpoint could not be read",
+                    remediation: GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION,
+                },
+    ];
+}
 export function conductorLedgerLoadabilitySection(legacyConductor) {
     const base = {
         id: "epic-implementer-ledger-loadability",

package/build/conductor/readiness.js

@@ -47,19 +47,28 @@
  * a local collector, and the Bridge API owner for a server-side collector that
  * keeps timing out or answering unreadably.
  *
- * ## Deferred retirement: local `gh` (AC-7)
- *
- * **Detection** is `conductor.gh-cli` and `conductor.gh-auth`, carried as two
- * separate checks because installing `gh` and authenticating it are two
- * different operator actions. **Containment** is the existing local-merge
- * execution path, which refuses and emits `merge.failed`/`merge.skipped` rather
- * than merging without auth — a missing `gh` degrades a run, it does not corrupt
- * one. **Escalation** targets the invoking operator first; there is no automated
- * fallback, because the GitHub App token is `contents: read` and structurally
- * cannot merge (see `mcp_server/src/executor/merge-job.ts`). **Retirement** is
- * owned by epic A2, after the App is elevated to `contents: write`. Until A2
- * ships this check is load-bearing and no code here may remove, hide, or
- * downgrade it.
+ * ## RETIRED deferral: local `gh` auth (AC-7, retired by BAPI-1136)
+ *
+ * This deferral named its retirement owner as epic A2, and A2 has now landed.
+ * It is recorded here rather than deleted, because the point of naming an owner
+ * is being able to check afterwards that the owner actually did the work.
+ *
+ * **What it used to be.** Detection was `conductor.gh-cli` and
+ * `conductor.gh-auth`: the merge ran under this host's own `gh` session, because
+ * the GitHub App token is `contents: read` and structurally cannot merge (see
+ * `mcp_server/src/executor/merge-job.ts`). Until A2 shipped, that ambient-session
+ * check was load-bearing.
+ *
+ * **What replaced it.** BAPI-1136 de-personalized the merge: it now authenticates
+ * with one explicitly configured, customer-held credential
+ * (`BAPI_LOCAL_MERGE_TOKEN` or `BAPI_MACHINE_MERGE_TOKEN`) and never with the
+ * ambient session. So the second check was RE-POINTED, not removed —
+ * `conductor.gh-cli` still asks whether `gh` exists, and
+ * `conductor.merge-credential` asks whether a credential is configured. Removing
+ * it would have been a silent downgrade; leaving it would have been worse, since
+ * it reported green on exactly the hosts about to fail closed. **Containment** and
+ * **escalation** are unchanged: the merge refuses with a named reason rather than
+ * merging without a credential, and the invoking operator is the first target.
  *
  * ## Deferred retirement: native SQLite ledger (AC-7)
  *
@@ -87,9 +96,11 @@ import { mapConductorDoctorReportToReadinessChecks, } from "./doctor.js";
 import { mapInstallStatusChecksToReadinessChecks, } from "../install-doctor.js";
 import { mapPlanePreflightToReadinessChecks, } from "../plane/preflight.js";
 import { runConductorInstallDoctor, } from "./install-doctor.js";
-import { BRING_UP_SECTION_LABELS } from "./readiness-sections.js";
+import { BRING_UP_SECTION_LABELS, presentRequiredChecks, } from "./readiness-sections.js";
 import { classifyBringUpFacts } from "./bring-up-facts.js";
+import { classifyMergeExecutionEligibility, MERGE_EXECUTION_INELIGIBLE_REMEDIATION, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
 import { createReadinessCheck, createReadinessCheckSafely, summarizeReadinessChecks, validateReadinessChecks, } from "../readiness-check.js";
+import { ADMISSION_EVIDENCE_SCHEMA_VERSION, } from "./bridge-api-client.js";
 /** This report's own schema version. See the module docstring. */
 export const CONDUCTOR_READINESS_GATE_SCHEMA_VERSION = 1;
 /** Fixed statement carried in every report, so no consumer can mistake it for a gate. */
@@ -110,6 +121,13 @@ export const SERVER_READINESS_DESCRIPTORS = [
     { id: "review-policy", label: "Review policy" },
     { id: "github-credentials", label: "GitHub App credentials" },
     { id: "github-actions-permission", label: "GitHub App actions permission" },
+    // BAPI-1135 — merge-execution eligibility, BESIDE the App permission row and
+    // never replacing it: that row is the installation's dispatch/rerun
+    // permission, these two are the merge workflow and the branch policy that
+    // governs it. Two rows rather than one, because a workflow that is absent and
+    // a branch policy that excludes the actor are separately actionable.
+    { id: "merge-execution-workflow", label: "Merge workflow eligibility" },
+    { id: "merge-execution-branch-policy", label: "Merge branch policy" },
     // BAPI-1153 — the "Bring-up safety" group: deployment-wide facts that decide
     // whether a plane can drive a run at all, ahead of the repository-scoped
     // reconciler/executor rows. Labels come from the shared section layer.
@@ -153,7 +171,6 @@ const SERVER_FAILURE_COPY = {
 const SERVER_REMEDIATIONS = {
     supervisorSetup: "run `install conductor` (or `setup-epic`) for this repository to write the project-default supervisor posture.",
     supervisorConfig: "run `install conductor` for this repository to write the project-default supervisor configuration.",
-    requiredChecks: "configure a non-empty required-check list in done_gate_config; an empty list makes the done gate pass unconditionally.",
     mergeApproval: "set the merge-approval requirement explicitly in the supervisor configuration rather than leaving it unset.",
     reviewPolicyMissing: "set the repository review-policy default so the merge path and the code_review gate read the same signal.",
     reviewPolicyDivergent: "align the repository review-policy default with the done gate's review_state condition, or confirm the difference is intended.",
@@ -163,7 +180,7 @@ const SERVER_REMEDIATIONS = {
     reconcilerUnreadable: "retry once the Bridge API is reachable; reconciler liveness is unknown here, not confirmed stale.",
     reconcilerStale: "start the reconciler for this repository (the `epic-implementer epic-tick` schedule) so ticks resume.",
     executorUnreadable: "retry once the Bridge API is reachable; no executor readiness claim is ever made from local state.",
-    executorNeverSeen: "provision and start an executor (`install conductor --executor-id <id>` or `executor install-service`); readiness comes only from a live server observation.",
+    executorNeverSeen: "provision and start an executor (`install conductor --executor-id <id> --repo-wide` or `executor install-service`); readiness comes only from a live server observation.",
     executorStale: "restart the executor service; it was observed once and has gone quiet past the server's staleness threshold.",
     reviewWorkflowUnknown: "re-run; the default branch's review workflow could not be evaluated, which is not the same as it being absent.",
     reviewWorkflowIncomplete: "install the claude-review workflow template on the default branch so it emits both the run id and the reviewed SHA the verdict protocol reads.",
@@ -175,6 +192,11 @@ const SERVER_REMEDIATIONS = {
     unattendedConsent: "set `unattended_epic_implementer_allowed` for this repository (docs/claude/account-settings-operator-runbook.md), or run setup with --attended.",
     unattendedNotifyDefault: "supply a --policy-file declaring notify.webhook_url, or run setup with --attended; an unattended run must have a working escalation channel, and notify.local_sink is not one.",
     repositoryWorkflowReadiness: "run `install-bridge conductor` so the review and conductor-CI workflows are confirmed on the default branch, or run setup with --attended.",
+    // BAPI-1135. Both are IMPORTED from the shared classifier rather than written
+    // out here, so the remedy command has exactly one spelling across the refusal,
+    // the readiness row, and the doctor — see `merge-execution-contract.ts`.
+    mergeExecutionUnverifiable: MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION,
+    mergeExecutionIneligible: MERGE_EXECUTION_INELIGIBLE_REMEDIATION,
 };
 /**
  * Project the validated server readiness response into `server.*` checks.
@@ -230,18 +252,20 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
         });
     // Counts and booleans are safe facts and stay in `detail`; they never become
     // checks of their own, because there is nothing separate to remediate.
-    outcomes.push(s.required_checks_empty
-        ? {
-            id: "supervisor-required-checks",
-            status: "warn",
-            detail: "the required-check list is EMPTY — the done gate would pass unconditionally",
-            remediation: SERVER_REMEDIATIONS.requiredChecks,
-        }
-        : {
-            id: "supervisor-required-checks",
-            status: "pass",
-            detail: `${s.required_checks_count} required check(s) configured`,
-        });
+    //
+    // BAPI-1254: a nonempty count is not proof. The shared presentation — the same
+    // one the install-time section renders — passes ONLY a server `verified`
+    // verdict; a confirmed mismatch, could-not-verify, an empty list, and an older
+    // server's silence all fail, with distinct fixed copy.
+    const requiredChecks = presentRequiredChecks(s);
+    outcomes.push({
+        id: "supervisor-required-checks",
+        status: requiredChecks.satisfied ? "pass" : "fail",
+        detail: requiredChecks.detail,
+        ...(requiredChecks.remediation === undefined
+            ? {}
+            : { remediation: requiredChecks.remediation }),
+    });
     // Auto-merge OFF is a posture, not a gap: an operator may deliberately merge
     // by hand. Reported, never remediated.
     outcomes.push({
@@ -279,6 +303,7 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
             remediation: SERVER_REMEDIATIONS.githubCredentials,
         });
     outcomes.push(githubActionsOutcome(readiness));
+    outcomes.push(...mergeExecutionOutcomes(readiness));
     outcomes.push(...bringUpOutcomes(readiness));
     outcomes.push(reconcilerOutcome(readiness));
     outcomes.push(executorOutcome(readiness));
@@ -286,7 +311,7 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
     outcomes.push(ciWorkflowOutcome(readiness));
     outcomes.push(...unattendedOutcomes(readiness));
     const byId = new Map(outcomes.map((outcome) => [outcome.id, outcome]));
-    return SERVER_READINESS_DESCRIPTORS.map(({ id, label }) => {
+    const described = SERVER_READINESS_DESCRIPTORS.map(({ id, label }) => {
         const outcome = byId.get(id);
         if (!outcome) {
             return createReadinessCheck({
@@ -309,6 +334,97 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
                 : { remediation: outcome.remediation ?? SERVER_REMEDIATIONS.olderServer }),
         });
     });
+    // BAPI-1260 — appended ONLY when the server reported the block, so every
+    // pre-BAPI-1260 report keeps exactly the descriptor set above.
+    return [...described, ...admissionEvidenceChecks(readiness)];
+}
+/** Human labels for the known BAPI-1260 evidence predicates. */
+const ADMISSION_EVIDENCE_LABELS = {
+    unattended_consent: "Launch evidence: unattended consent",
+    notify_webhook: "Launch evidence: notification destination",
+    repository_readiness: "Launch evidence: repository workflows",
+    required_checks: "Launch evidence: required CI checks",
+    index_provenance: "Launch evidence: canonical index provenance",
+    durable_actor: "Launch evidence: durable actor handshake",
+    migration_head: "Launch evidence: database migration head",
+};
+/** Who acts, in fixed prose. Never a value from the payload. */
+const ADMISSION_OWNER_REMEDIATION = {
+    operator: "the operator re-runs guided setup (`install conductor --launch-profile <name>`) and re-observes.",
+    repository_admin: "a repository administrator resolves it through the account-settings runbook; setup never grants it.",
+    bridge_operations: "escalate to Bridge operations; this is not something an operator command can change.",
+};
+/**
+ * Project the server's typed launch evidence (BAPI-1260) into `server.*`
+ * checks, read-only.
+ *
+ * The CLIENT decides nothing here: `confirmed` renders pass, `not_applicable`
+ * renders skip, and `denied` and `unable_to_verify` both render fail with
+ * DIFFERENT detail — a known denial and an inability to verify call for
+ * different actions, and neither authorizes a launch. The server is the only
+ * admission authority; this row is what it said, not a verdict of our own.
+ */
+export function admissionEvidenceChecks(readiness) {
+    const evidence = readiness.admission_evidence;
+    if (evidence === undefined)
+        return [];
+    if (evidence === null || evidence.schema_version !== ADMISSION_EVIDENCE_SCHEMA_VERSION) {
+        return [
+            createReadinessCheckSafely({
+                id: "server.admission-evidence",
+                source: "server",
+                label: "Launch evidence",
+                status: "fail",
+                detail: evidence === null
+                    ? "the server reported no launch evidence, so no mandatory prerequisite is proven"
+                    : "the server's launch-evidence schema is not one this CLI renders; treat every prerequisite as unverified",
+                remediation: "upgrade the CLI or the Bridge API deploy so both speak the same evidence schema.",
+            }),
+        ];
+    }
+    return evidence.records.map((record) => admissionEvidenceCheck(record));
+}
+function admissionEvidenceCheck(record) {
+    const slug = record.predicate.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
+    const label = ADMISSION_EVIDENCE_LABELS[record.predicate] ?? "Launch evidence";
+    const reason = record.reason ? ` (${record.reason})` : "";
+    const remediation = ADMISSION_OWNER_REMEDIATION[record.next_action_owner ?? "operator"] ?? ADMISSION_OWNER_REMEDIATION.operator;
+    switch (record.verdict) {
+        case "confirmed":
+            return createReadinessCheckSafely({
+                id: `server.admission-${slug}`,
+                source: "server",
+                label,
+                status: "pass",
+                detail: `confirmed by ${record.source}; fresh for ${record.max_age_seconds}s after observation`,
+            });
+        case "not_applicable":
+            return createReadinessCheckSafely({
+                id: `server.admission-${slug}`,
+                source: "server",
+                label,
+                status: "skip",
+                detail: `not applicable${reason}`,
+            });
+        case "denied":
+            return createReadinessCheckSafely({
+                id: `server.admission-${slug}`,
+                source: "server",
+                label,
+                status: "fail",
+                detail: `DENIED by ${record.source}${reason} — dependent activation, dispatch, and privileged operations are held`,
+                remediation,
+            });
+        default:
+            return createReadinessCheckSafely({
+                id: `server.admission-${slug}`,
+                source: "server",
+                label,
+                status: "fail",
+                detail: `could not be verified${reason} — unknown is not safe, so dependent work is held`,
+                remediation,
+            });
+    }
 }
 /**
  * The three BAPI-1153 bring-up safety rows.
@@ -460,6 +576,64 @@ function githubActionsOutcome(readiness) {
         remediation: SERVER_REMEDIATIONS.actionsMissing,
     };
 }
+/**
+ * The two BAPI-1135 merge-execution rows.
+ *
+ * Both are backed SOLELY by {@link classifyMergeExecutionEligibility}, so this
+ * gate, the install doctor's section, the `drive-epic` requirement, and the
+ * `setup-epic` refusal cannot disagree about the status or the first blocker.
+ * Nothing here re-reads the server block or re-derives a fact.
+ *
+ * A `could_not_verify` verdict produces a RETRY-oriented row on both, and never
+ * claims the capability is absent. A confirmed insufficiency produces a
+ * `not eligible` row carrying the exact shared remedy command. The two are
+ * deliberately different statuses — `fail` for confirmed, `warn` for unknown —
+ * so the visible status label distinguishes them without relying on colour.
+ *
+ * Which of the two rows carries the blocker is decided by the reason: a branch
+ * policy that could not be read or an actor that is not admitted belongs to the
+ * branch-policy row; everything else belongs to the workflow row. The other row
+ * then reports that it was not reached, rather than showing a misleading pass.
+ */
+function mergeExecutionOutcomes(readiness) {
+    const verdict = classifyMergeExecutionEligibility(readiness);
+    const branchScoped = verdict.reason === "branch_policy_unreadable" || verdict.reason === "actor_not_admitted";
+    if (verdict.status === "eligible") {
+        return [
+            {
+                id: "merge-execution-workflow",
+                status: "pass",
+                detail: verdict.detail,
+            },
+            {
+                id: "merge-execution-branch-policy",
+                status: "pass",
+                detail: "the branch policy admits the workflow actor",
+            },
+        ];
+    }
+    const status = verdict.status === "could_not_verify" ? "warn" : "fail";
+    const remediation = verdict.status === "could_not_verify"
+        ? SERVER_REMEDIATIONS.mergeExecutionUnverifiable
+        : SERVER_REMEDIATIONS.mergeExecutionIneligible;
+    const blocked = {
+        id: branchScoped ? "merge-execution-branch-policy" : "merge-execution-workflow",
+        status,
+        detail: verdict.status === "could_not_verify"
+            ? `could not verify: ${verdict.detail}`
+            : `not eligible: ${verdict.detail}`,
+        remediation,
+    };
+    // The row that did not decide reports exactly that. Showing it as a pass would
+    // claim evidence the classifier stopped short of gathering.
+    const notReached = {
+        id: branchScoped ? "merge-execution-workflow" : "merge-execution-branch-policy",
+        status: "warn",
+        detail: "could not verify: not evaluated — an earlier merge-eligibility fact decided first",
+        remediation,
+    };
+    return branchScoped ? [notReached, blocked] : [blocked, notReached];
+}
 /** Reconciler liveness, preserving the server's own `stale` conclusion. */
 function reconcilerOutcome(readiness) {
     const r = readiness.reconciler;

package/build/conductor/recovery-operations.js

@@ -20,7 +20,7 @@
 import { randomUUID } from "crypto";
 import { adoptCurrentHeadAndUnparkTicket, completeMergeChild, ConductorBridgeApiError, dispatchRemediation, fetchEpicRunState, mergeChild, patchPolicy, resumeRun, safeDiagnosticMessage, scopeCatchUp, scopeReparse, stopEpicRun, unparkEpicTicket, updateEpicRunStatus, } from "./bridge-api-client.js";
 import { DEFAULT_GATE_NAME } from "./git-ci-types.js";
-import { resolveLocalMergeMethod, runApprovedLocalMerge } from "./local-merge.js";
+import { resolveLocalMergeCredential, resolveLocalMergeMethod, runApprovedLocalMerge, } from "./local-merge.js";
 /**
  * Bounded total attempts for a ticket-recovery CAS retry loop. Each attempt
  * begins with a fresh, authoritative state read — so this bounds full
@@ -312,7 +312,13 @@ export async function mergeChildRepair(access, options, deps = {}) {
             // which is discarded — never the server's action key, which the server
             // recomposes itself at completion.
             action_key: `merge-child:${options.epicRunId}:${options.prNumber}`,
-        }, { method: resolveLocalMergeMethod(local.merge_method) }, { env: deps.env ?? process.env });
+        }, { method: resolveLocalMergeMethod(local.merge_method) }, 
+        // BAPI-1136: an explicitly configured local credential, never the ambient
+        // login. `env` remains the source of the allowlisted operational base only.
+        {
+            env: deps.env ?? process.env,
+            credential: resolveLocalMergeCredential(deps.env ?? process.env, "local"),
+        });
         succeeded = localResult.status === "succeeded";
         alreadyMerged = succeeded && localResult.reason === "already_merged";
         failureReason = boundedLocalMergeReason(localResult.reason);