@bridge_gpt/mcp-server 0.2.60 → 0.2.62

package/build/conductor/bridge-api-client.js

@@ -11,7 +11,8 @@
  */
 import os from "node:os";
 import { readFile, stat } from "node:fs/promises";
-import { resolveBapiCredentials } from "../credential-store.js";
+import { resolveBapiCredentials, resolveEpicLaunchCredential } from "../credential-store.js";
+import { readEpicLaunchProfile, resolveEpicLaunchTarget, } from "../epic-launch-profile.js";
 import { resolveStartTicketsRepoName } from "../start-tickets-repo.js";
 import { normalizePrNumber, normalizeSha } from "./git-ci-types.js";
 import { ConductorValidationError } from "./errors.js";
@@ -63,6 +64,87 @@ export async function resolveConductorBridgeApiAccess(deps = {}) {
         : CONDUCTOR_DEFAULT_BASE_URL;
     return { ok: true, access: { repoName, apiKey: credResult.credentials.apiKey, baseUrl } };
 }
+/**
+ * The STRONGER launch-resolution contract (BAPI-1260), used by `drive-epic` and
+ * by a `setup-epic` that was handed a launch selection. The order is the point:
+ *
+ *   1. the selected profile is read and validated (host-local, read-only);
+ *   2. the TARGET is decided from `--base-url`, the profile, and `BAPI_BASE_URL`
+ *      — conflicts refuse, and an absent target is refused, never defaulted to
+ *      {@link CONDUCTOR_DEFAULT_BASE_URL};
+ *   3. the repository is decided (profile binding, then `--repo`, then the
+ *      shared resolver);
+ *   4. only then is a credential looked up, coupled to that target AND that
+ *      repository ({@link resolveEpicLaunchCredential}).
+ *
+ * Nothing is sent anywhere by this function. {@link resolveConductorBridgeApiAccess}
+ * is deliberately left as it is for every other client.
+ */
+export async function resolveEpicLaunchBridgeApiAccess(selection, deps = {}) {
+    const env = deps.env ?? process.env;
+    const cwd = deps.cwd ?? process.cwd();
+    const homedir = deps.homedir ?? os.homedir;
+    const platform = deps.platform ?? process.platform;
+    const readFileImpl = deps.readFile ?? ((p) => readFile(p, "utf-8"));
+    const statImpl = deps.stat ?? ((p) => stat(p));
+    let profile = null;
+    if (selection.profileName !== undefined) {
+        const read = await readEpicLaunchProfile(selection.profileName, {
+            env,
+            homedir,
+            readFile: readFileImpl,
+            host: (deps.hostname ?? os.hostname)(),
+        });
+        if (!read.ok)
+            return { ok: false, kind: "profile-unusable", error: read.message };
+        profile = read.profile;
+    }
+    const target = resolveEpicLaunchTarget({
+        flagBaseUrl: selection.baseUrl,
+        flagRepo: deps.repoName,
+        profile,
+        env,
+    });
+    if (!target.ok)
+        return { ok: false, kind: target.kind, error: target.message };
+    const repoName = target.repoName ||
+        deps.repoName?.trim() ||
+        (await resolveStartTicketsRepoName({ env, cwd, readFile: readFileImpl }));
+    if (!repoName) {
+        return {
+            ok: false,
+            kind: "repo-missing",
+            error: "could not resolve repo name (set BAPI_REPO_NAME or add a valid .bridge/config)",
+        };
+    }
+    let cred;
+    try {
+        cred = await resolveEpicLaunchCredential(repoName, target.baseUrl, {
+            env,
+            homedir,
+            platform,
+            readFile: readFileImpl,
+            stat: statImpl,
+        });
+    }
+    catch {
+        return { ok: false, kind: "credentials-unavailable", error: "failed to resolve Bridge API credentials" };
+    }
+    if (!cred.ok) {
+        const bindingFailure = cred.kind === "binding-unbound" || cred.kind === "binding-mismatch" || cred.kind === "ambient-key-unbound";
+        // The binding messages are fixed sentences naming the target KEY and the
+        // store path only; the generic store failures stay generic as before.
+        return bindingFailure
+            ? { ok: false, kind: "credential-unbound", error: cred.error }
+            : { ok: false, kind: "credentials-unavailable", error: "Bridge API credentials unavailable" };
+    }
+    return {
+        ok: true,
+        access: { repoName, apiKey: cred.apiKey, baseUrl: target.baseUrl },
+        targetSource: target.source,
+        profile,
+    };
+}
 /**
  * Build a `${baseUrl}/jira${apiPath}` URL with query params, trimming trailing
  * slashes on the base so there is never a double slash after the host. Query
@@ -1983,12 +2065,109 @@ export async function getEpicPlan(access, epicKey, planVersion, fetchImpl = glob
     const parsed = await fetchConductorJsonWithTimeout(url, conductorGetHeaders(access), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
     return parsed;
 }
+/**
+ * BAPI-1252: the backend's closed canonical refusal vocabulary, mirrored as
+ * string literals (the Python source is `api/models/canonical_index_state.py`;
+ * a test pins the two together). A refusal carries exactly one of these and
+ * nothing else — no SHA, generation, owner, or server error text.
+ */
+export const CANONICAL_REFUSAL_REASONS = [
+    "canonical_validity_unavailable",
+    "canonical_index_unverified",
+    "canonical_source_missing",
+    "canonical_generation_mismatch",
+    "canonical_manifest_mismatch",
+    "canonical_index_advanced",
+    "canonical_capability_unsupported",
+];
+/** The canonical validity states the backend can report. */
+export const CANONICAL_VALIDITY_STATES = ["unverified", "writing", "verified"];
+/** The only canonical manifest versions this client accepts as evidence. */
+export const SUPPORTED_CANONICAL_MANIFEST_VERSIONS = ["v1"];
+const CANONICAL_PROVENANCE_KEYS = [
+    "canonical_validity_state",
+    "canonical_validity_verified",
+    "canonical_source_commit_sha",
+    "canonical_generation",
+    "canonical_manifest_version",
+    "canonical_validity_reason",
+];
+const FULL_COMMIT_SHA_RE = /^[0-9a-f]{40}$/;
+const CANONICAL_GENERATION_RE = /^[A-Za-z0-9_.:-]{1,128}$/;
+/**
+ * BAPI-1252: decode a `/jira/parse-status` body's canonical provenance, failing
+ * CLOSED. Only an explicit `verified` state, a literal `true` verified flag, a
+ * full lowercase 40-character source SHA, a well-formed generation, a supported
+ * manifest version, and no refusal reason decode as evidence. Everything else is
+ * one bounded refusal:
+ *
+ * - all six fields absent (an older server) → `canonical_capability_unsupported`;
+ * - an unknown state, an unknown manifest version, a malformed SHA or
+ *   generation, a non-boolean flag, or an unknown reason token →
+ *   `canonical_capability_unsupported` (the client cannot prove it, so it is not
+ *   proof);
+ * - a known refusal reason → that reason;
+ * - any non-verified state → `canonical_index_unverified`.
+ *
+ * Pure and total: it never throws and never consults lifecycle fields such as
+ * `status` or `indexed_commit_sha`.
+ */
+export function decodeCanonicalProvenance(body) {
+    const unsupported = { verified: false, reason: "canonical_capability_unsupported" };
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return unsupported;
+    const obj = body;
+    const present = CANONICAL_PROVENANCE_KEYS.some((key) => key in obj && obj[key] !== undefined);
+    if (!present)
+        return unsupported;
+    const reason = obj.canonical_validity_reason;
+    if (reason !== undefined && reason !== null) {
+        if (typeof reason !== "string")
+            return unsupported;
+        if (!CANONICAL_REFUSAL_REASONS.includes(reason))
+            return unsupported;
+        return { verified: false, reason: reason };
+    }
+    const flag = obj.canonical_validity_verified;
+    if (flag !== undefined && flag !== null && typeof flag !== "boolean")
+        return unsupported;
+    const state = obj.canonical_validity_state;
+    if (typeof state !== "string")
+        return unsupported;
+    if (!CANONICAL_VALIDITY_STATES.includes(state))
+        return unsupported;
+    if (state !== "verified" || flag !== true) {
+        return { verified: false, reason: "canonical_index_unverified" };
+    }
+    const sha = obj.canonical_source_commit_sha;
+    const generation = obj.canonical_generation;
+    const version = obj.canonical_manifest_version;
+    if (typeof sha !== "string" || !FULL_COMMIT_SHA_RE.test(sha))
+        return unsupported;
+    if (typeof generation !== "string" || !CANONICAL_GENERATION_RE.test(generation)) {
+        return unsupported;
+    }
+    if (typeof version !== "string" ||
+        !SUPPORTED_CANONICAL_MANIFEST_VERSIONS.includes(version)) {
+        return unsupported;
+    }
+    return {
+        verified: true,
+        sourceCommitSha: sha,
+        generation,
+        manifestVersion: version,
+    };
+}
 /**
  * GET `/jira/parse-status?repo_name=<repo>` and return the durable parse-run
  * status. See {@link ParseRepositoryStatusValue} for the full state set (the
  * status surface distinguishes queued/running from terminal succeeded/failed).
  * Throws a sanitized {@link ConductorBridgeApiError} on any transport/auth/server
  * failure. URL + auth are unchanged from the pre-BAPI-527 two-state client.
+ *
+ * BAPI-1252: the body is returned as the server sent it, so a payload from an
+ * older server (no canonical fields) still decodes exactly as before. Canonical
+ * provenance is read from it only through {@link decodeCanonicalProvenance}.
  */
 export async function fetchParseStatus(access, fetchImpl = globalThis.fetch) {
     const url = buildConductorJiraUrl(access.baseUrl, "/parse-status", {
@@ -2092,6 +2271,21 @@ export const CONDUCTOR_REVIEW_ALIGNMENT_STATUSES = new Set([
     "not_configured",
     "invalid",
 ]);
+/** The closed verdict vocabulary the parser accepts. */
+export const REQUIRED_CHECKS_VERIFICATIONS = new Set([
+    "verified",
+    "unknown_name",
+    "unverifiable",
+]);
+/** BAPI-1260 — one mandatory-evidence verdict. Only `confirmed` ever holds. */
+export const ADMISSION_EVIDENCE_VERDICTS = [
+    "confirmed",
+    "denied",
+    "unable_to_verify",
+    "not_applicable",
+];
+/** The evidence schema this client renders. A newer one is shown as unknown, never as held. */
+export const ADMISSION_EVIDENCE_SCHEMA_VERSION = 1;
 /** Upper bound of the server's capped `fresh_reconciler_count` ("two or more"). */
 export const READINESS_FRESH_RECONCILER_COUNT_CAP = 2;
 const READINESS_SOURCES = new Set(["epic", "project_default", "none"]);
@@ -2178,6 +2372,89 @@ function requireEnum(o, key, allowed) {
         throw readinessShapeError();
     return v;
 }
+/** The five BAPI-1254 supervisor keys, which travel as one all-or-none group. */
+const REQUIRED_CHECKS_VERIFICATION_KEYS = [
+    "required_checks_verification",
+    "required_checks_mismatch_count",
+    "required_checks_unverified_count",
+    "required_checks_evidence_observed_at",
+    "required_checks_evidence_fresh",
+];
+/**
+ * A strict ISO-8601 instant with an EXPLICIT UTC designator (`Z` or `+00:00`).
+ * A timezone-free or offset time is rejected rather than read in local time.
+ */
+const UTC_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,9})?(Z|\+00:00)$/;
+function requireNonNegativeInt(o, key) {
+    const v = requireInt(o, key);
+    if (v < 0)
+        throw readinessShapeError();
+    return v;
+}
+/**
+ * Parse the BAPI-1254 required-check verification group, FAIL-CLOSED.
+ *
+ * All five keys ABSENT is an older server: every field becomes `null`, which
+ * every consumer renders as "could not verify" — absence is never verification.
+ * Any key present makes all five mandatory, and each is checked for exact type:
+ * the verdict against its closed vocabulary, both counts as non-negative
+ * integers, the time as an explicit-UTC instant, freshness as a real boolean.
+ * The server's cross-field invariants are then re-applied, because a
+ * contradictory group (a `verified` with a mismatch, a stale `unknown_name`)
+ * is untrusted input, not a verdict to render.
+ */
+function parseRequiredChecksVerification(sup, requiredChecksCount) {
+    const present = REQUIRED_CHECKS_VERIFICATION_KEYS.filter((key) => Object.prototype.hasOwnProperty.call(sup, key) && sup[key] !== undefined);
+    if (present.length === 0) {
+        return {
+            required_checks_verification: null,
+            required_checks_mismatch_count: null,
+            required_checks_unverified_count: null,
+            required_checks_evidence_observed_at: null,
+            required_checks_evidence_fresh: null,
+        };
+    }
+    if (present.length !== REQUIRED_CHECKS_VERIFICATION_KEYS.length)
+        throw readinessShapeError();
+    const verification = requireEnum(sup, "required_checks_verification", REQUIRED_CHECKS_VERIFICATIONS);
+    const mismatch = requireNonNegativeInt(sup, "required_checks_mismatch_count");
+    const unverified = requireNonNegativeInt(sup, "required_checks_unverified_count");
+    const observedAt = sup.required_checks_evidence_observed_at;
+    if (typeof observedAt !== "string" ||
+        !UTC_TIMESTAMP_PATTERN.test(observedAt) ||
+        Number.isNaN(Date.parse(observedAt))) {
+        throw readinessShapeError();
+    }
+    const fresh = requireBool(sup, "required_checks_evidence_fresh");
+    if (requiredChecksCount < 0 || mismatch + unverified > requiredChecksCount) {
+        throw readinessShapeError();
+    }
+    if (verification === "verified" &&
+        !(requiredChecksCount > 0 && mismatch === 0 && unverified === 0 && fresh)) {
+        throw readinessShapeError();
+    }
+    if (verification === "unknown_name" && !(fresh && mismatch > 0))
+        throw readinessShapeError();
+    if (verification === "unverifiable" && mismatch > 0)
+        throw readinessShapeError();
+    return {
+        required_checks_verification: verification,
+        required_checks_mismatch_count: mismatch,
+        required_checks_unverified_count: unverified,
+        required_checks_evidence_observed_at: observedAt,
+        required_checks_evidence_fresh: fresh,
+    };
+}
+/** Optional positive-integer threshold: absent/null from an older server. */
+function parseOptionalPositiveInt(o, key) {
+    const v = o[key];
+    if (v === undefined || v === null)
+        return null;
+    const parsed = requireInt(o, key);
+    if (parsed <= 0)
+        throw readinessShapeError();
+    return parsed;
+}
 /**
  * Validate a raw readiness body into the typed response, FAIL-CLOSED.
  *
@@ -2197,6 +2474,7 @@ export function parseConductorReadinessResponse(body) {
     const rec = requireObject(root.reconciler);
     const exec = requireObject(root.executor);
     const thr = requireObject(root.thresholds);
+    const requiredChecksCount = requireInt(sup, "required_checks_count");
     return {
         repo_name: repoName,
         supervisor: {
@@ -2208,13 +2486,14 @@ export function parseConductorReadinessResponse(body) {
             config_source: requireEnum(sup, "config_source", READINESS_SOURCES),
             config_created_at: requireNullableString(sup, "config_created_at"),
             config_updated_at: requireNullableString(sup, "config_updated_at"),
-            required_checks_count: requireInt(sup, "required_checks_count"),
+            required_checks_count: requiredChecksCount,
             required_checks_empty: requireBool(sup, "required_checks_empty"),
             auto_merge_enabled: requireBool(sup, "auto_merge_enabled"),
             merge_approval_required_set: requireBool(sup, "merge_approval_required_set"),
             review_policy_alignment: parseReviewPolicyAlignment(sup),
             // Absent on a pre-BAPI-694 server, where no repository default can exist.
             review_policy_present: sup.review_policy_present === true,
+            ...parseRequiredChecksVerification(sup, requiredChecksCount),
         },
         github: {
             credentials_readable: requireBool(gh, "credentials_readable"),
@@ -2244,13 +2523,85 @@ export function parseConductorReadinessResponse(body) {
         thresholds: {
             reconciler_stale_after_seconds: requireInt(thr, "reconciler_stale_after_seconds"),
             executor_stale_after_seconds: requireInt(thr, "executor_stale_after_seconds"),
+            required_checks_evidence_max_age_seconds: parseOptionalPositiveInt(thr, "required_checks_evidence_max_age_seconds"),
         },
         review_workflow: parseReviewWorkflow(root),
         conductor_ci_workflow: parseConductorCiWorkflow(root),
         unattended: parseUnattended(root),
         bring_up: parseBringUp(root),
         merge_execution: parseMergeExecution(root),
+        ...(() => {
+            const evidence = parseAdmissionEvidence(root);
+            return evidence === undefined ? {} : { admission_evidence: evidence };
+        })(),
+    };
+}
+const ADMISSION_EVIDENCE_OWNERS = new Set(["operator", "repository_admin", "bridge_operations"]);
+const BOUNDED_TOKEN = /^[a-z0-9][a-z0-9_.:-]{0,79}$/;
+/**
+ * Parse the optional BAPI-1260 `admission_evidence` block.
+ *
+ * Absent → `undefined` (the key is then omitted from the parsed response).
+ * Present → validated strictly, EXCEPT that an unrecognized verdict is coerced
+ * to `unable_to_verify` rather than failing the whole readiness read: a newer
+ * server's vocabulary must degrade to "not proven", never to "held" and never
+ * to "no readiness at all". Free-text fields are bounded tokens only, so a
+ * payload cannot smuggle prose into operator output.
+ */
+function parseAdmissionEvidence(body) {
+    const raw = body.admission_evidence;
+    if (raw === undefined)
+        return undefined;
+    if (raw === null)
+        return null;
+    const o = requireObject(raw);
+    const schemaVersion = requireInt(o, "schema_version");
+    const observedAt = o.observed_at;
+    if (typeof observedAt !== "string")
+        throw readinessShapeError();
+    if (!Array.isArray(o.records) || o.records.length > 32)
+        throw readinessShapeError();
+    const token = (value, nullable) => {
+        if (value === null && nullable)
+            return null;
+        if (typeof value !== "string" || !BOUNDED_TOKEN.test(value))
+            throw readinessShapeError();
+        return value;
     };
+    const records = o.records.map((entry) => {
+        const r = requireObject(entry);
+        const verdictRaw = r.verdict;
+        const verdict = ADMISSION_EVIDENCE_VERDICTS.includes(verdictRaw)
+            ? verdictRaw
+            : "unable_to_verify";
+        const owner = r.next_action_owner;
+        if (owner !== null && owner !== undefined && !ADMISSION_EVIDENCE_OWNERS.has(owner)) {
+            throw readinessShapeError();
+        }
+        const maxAge = requireInt(r, "max_age_seconds");
+        if (maxAge <= 0)
+            throw readinessShapeError();
+        const at = r.observed_at;
+        if (at !== null && typeof at !== "string")
+            throw readinessShapeError();
+        return {
+            predicate: token(r.predicate, false),
+            verdict,
+            observed_at: at,
+            source: token(r.source, false),
+            source_version: r.source_version === null || r.source_version === undefined
+                ? null
+                : typeof r.source_version === "string" && r.source_version.length <= 80
+                    ? r.source_version
+                    : (() => {
+                        throw readinessShapeError();
+                    })(),
+            max_age_seconds: maxAge,
+            reason: r.reason === undefined ? null : token(r.reason, true),
+            next_action_owner: (owner ?? null),
+        };
+    });
+    return { schema_version: schemaVersion, observed_at: observedAt, records };
 }
 /**
  * Parse the optional `merge_execution` block (BAPI-1135).

package/build/conductor/merge-execution-contract.js

@@ -47,13 +47,38 @@ export const MERGE_WORKFLOW_IDENTIFIER = "epic-implementer-merge.yml";
 /** The top-level workflow key carrying the machine-readable contract version. */
 export const MERGE_WORKFLOW_VERSION_MARKER_KEY = "x-bridge-merge-contract-version";
 /**
- * The ONLY workflow contract version this CLI understands.
+ * The workflow contract version this CLI RENDERS and installs.
  *
- * Exact equality. A newer version is a workflow this build has never been taught
- * to reason about, so it is NOT eligible — see
- * {@link classifyMergeExecutionEligibility}.
+ * BAPI-1259 moved it from `1` to `2` (the integration-action job and the
+ * `operation` dispatch input). Whether an INSTALLED version is usable is
+ * answered by the two closed sets below — never by "at least". A newer version
+ * is a workflow this build has never been taught to reason about, so it is NOT
+ * eligible — see {@link classifyMergeExecutionEligibility}.
  */
-export const MERGE_WORKFLOW_EXPECTED_VERSION = 1;
+export const MERGE_WORKFLOW_EXPECTED_VERSION = 2;
+/**
+ * Installed contract versions a CHILD merge may be dispatched to. Mirrors
+ * `MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS` in the Python contract.
+ * Version 1's child-merge job is the behavior version 2 keeps unchanged.
+ */
+export const MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS = [1, 2];
+/**
+ * Installed contract versions an INTEGRATION action may be dispatched to.
+ * Mirrors `INTEGRATION_ACTION_WORKFLOW_VERSIONS` in the Python contract.
+ */
+export const INTEGRATION_ACTION_WORKFLOW_VERSIONS = [2];
+/** True when an installed marker may receive a child-merge dispatch. */
+export function mergeWorkflowVersionSupportsChildMerge(version) {
+    return (typeof version === "number" &&
+        Number.isInteger(version) &&
+        MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS.includes(version));
+}
+/** True when an installed marker may receive an integration-action dispatch. */
+export function mergeWorkflowVersionSupportsIntegrationActions(version) {
+    return (typeof version === "number" &&
+        Number.isInteger(version) &&
+        INTEGRATION_ACTION_WORKFLOW_VERSIONS.includes(version));
+}
 /**
  * The single command that generates the merge workflow and opens its pull
  * request. Every refusal, remediation, and readiness line imports this constant.

package/build/conductor/merge-execution-eligibility.js

@@ -23,14 +23,15 @@
  * credentials or connectivity. Collapsing them sends half of all operators to do
  * work that changes nothing. `could_not_verify` is never treated as eligible.
  *
- * ## Exact version, always
+ * ## Known versions only, always
  *
- * Eligibility requires {@link MERGE_WORKFLOW_EXPECTED_VERSION} exactly. A NEWER
- * version is not eligible either: it is a workflow this build has never been
- * taught to reason about, and "newer is probably fine" is a guess about a merge
- * actuator.
+ * Eligibility requires membership in the closed set
+ * {@link MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS} (BAPI-1259: version 1
+ * and version 2 both carry the unchanged child-merge job). A NEWER version is
+ * not eligible: it is a workflow this build has never been taught to reason
+ * about, and "newer is probably fine" is a guess about a merge actuator.
  */
-import { MERGE_WORKFLOW_EXPECTED_VERSION, MERGE_WORKFLOW_REMEDY_COMMAND, } from "./merge-execution-contract.js";
+import { MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS, MERGE_WORKFLOW_REMEDY_COMMAND, mergeWorkflowVersionSupportsChildMerge, } from "./merge-execution-contract.js";
 /**
  * Remediation for a verdict that could not be established.
  *
@@ -107,10 +108,10 @@ export function classifyMergeExecutionEligibility(readiness) {
     if (!m.merge_workflow_enabled) {
         return ineligible("workflow_disabled", "the merge workflow is present but disabled");
     }
-    if (m.merge_workflow_version !== MERGE_WORKFLOW_EXPECTED_VERSION) {
+    if (!mergeWorkflowVersionSupportsChildMerge(m.merge_workflow_version)) {
         // A newer version lands here too — see the module docstring.
         return ineligible("workflow_version_mismatch", `merge workflow version ${m.merge_workflow_version ?? "unset"} ` +
-            `(expected ${MERGE_WORKFLOW_EXPECTED_VERSION})`);
+            `(expected one of ${MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS.join(", ")})`);
     }
     if (!gh.actions_write) {
         return ineligible("app_actions_write_denied", `the GitHub App holds actions: ${gh.actions_permission_level}`);
@@ -123,7 +124,7 @@ export function classifyMergeExecutionEligibility(readiness) {
     }
     return {
         status: "eligible",
-        detail: `merge workflow present, enabled, version ${MERGE_WORKFLOW_EXPECTED_VERSION}; ` +
+        detail: `merge workflow present, enabled, version ${m.merge_workflow_version}; ` +
             "App actions: write, workflow token write authority, workflow actor admitted",
     };
 }

package/build/conductor/readiness-sections.js

@@ -38,7 +38,7 @@ import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { CLAUDE_REVIEW_WORKFLOW_DRIFT_REMEDIATION, summarizeClaudeReviewWorkflowDrift, } from "../claude-review-workflow-drift.js";
 import { describeNativeLedgerAvailability, GH_ACTIONS_MERGE_AUTH_REMEDIATION, GH_ACTIONS_MERGE_SKIPPED_DETAIL, GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION, } from "./doctor.js";
 import { classifyMergeExecutionEligibility, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
-import { MERGE_WORKFLOW_EXPECTED_VERSION, MERGE_WORKFLOW_PATH, } from "./merge-execution-contract.js";
+import { MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS, MERGE_WORKFLOW_PATH, mergeWorkflowVersionSupportsChildMerge, } from "./merge-execution-contract.js";
 import { classifyDatabaseMigration, classifySingleTransitionAuthority, classifyWorkerPresent, } from "./bring-up-facts.js";
 /** Operator runbook pointer surfaced beside the executor gap. */
 export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-implementer-v2-operator-runbook.md";
@@ -80,6 +80,88 @@ export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit
 export const EXECUTOR_SERVICE_START_REMEDIATION = "start the service (re-run `install conductor` and accept the start consent, or run the " +
     `printed launchctl/systemctl command by hand) — see ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`;
 // ---------------------------------------------------------------------------
+// BAPI-1254 — the ONE required-check presentation
+// ---------------------------------------------------------------------------
+/**
+ * Operator-hold sentence shared by every non-verified outcome. It states what an
+ * operator must do; it does not claim this report blocks anything — activation
+ * and dispatch enforcement belong to a separate slice.
+ */
+const REQUIRED_CHECKS_OPERATOR_HOLD = "hold new unattended epic work until this is resolved";
+/** Fixed, secret-free copy for each outcome. Names no check, branch, or SHA. */
+export const REQUIRED_CHECKS_PRESENTATION_COPY = {
+    verified: {
+        detail: "Verified — every configured required check is produced by the lane workflows",
+    },
+    unknown_name: {
+        detail: "Configuration mismatch confirmed — a configured required check conflicts with the " +
+            `current lane producer contract; ${REQUIRED_CHECKS_OPERATOR_HOLD}`,
+        remediation: "repair the project-default required-check configuration so it names the check the " +
+            "lane workflow emits (see the operator runbook's patch-policy section for active runs).",
+    },
+    unverifiable: {
+        detail: "Could not verify — the configured required checks could not be matched to an " +
+            `authoritative producer; ${REQUIRED_CHECKS_OPERATOR_HOLD}`,
+        remediation: "restore required-check verification (a readable default branch with static lane " +
+            "workflows and a current Bridge API), or correct the required-check configuration.",
+    },
+    empty: {
+        detail: "Could not verify — the required-check list is EMPTY, which is unsafe: the done gate " +
+            `would pass unconditionally; ${REQUIRED_CHECKS_OPERATOR_HOLD}`,
+        remediation: "configure a non-empty required-check list naming the checks the lane workflows emit.",
+    },
+    olderServer: {
+        detail: "Could not verify — this Bridge API does not report required-check verification; " +
+            REQUIRED_CHECKS_OPERATOR_HOLD,
+        remediation: "upgrade the Bridge API deploy so it verifies required checks, or correct the " +
+            "required-check configuration; its state is unknown here, not healthy.",
+    },
+};
+/**
+ * Map the validated supervisor facts onto one required-check presentation.
+ *
+ * PURE, and the only place either renderer decides this row: the CLI descriptor
+ * and the install-time section both call it, so they cannot drift and neither
+ * performs a second producer verification. Only the server's `verified` verdict
+ * is satisfied. A nonempty count is never proof, an older server's absent group
+ * is `unverifiable`, and an empty list stays unsafe whatever else is reported.
+ * No remediation suggests disabling required checks.
+ */
+export function presentRequiredChecks(supervisor) {
+    const verdict = supervisor.required_checks_verification ?? null;
+    if (supervisor.required_checks_empty) {
+        return { outcome: "unverifiable", satisfied: false, ...REQUIRED_CHECKS_PRESENTATION_COPY.empty };
+    }
+    if (verdict === null) {
+        return {
+            outcome: "unverifiable",
+            satisfied: false,
+            ...REQUIRED_CHECKS_PRESENTATION_COPY.olderServer,
+        };
+    }
+    if (verdict === "verified") {
+        const fresh = supervisor.required_checks_evidence_fresh === true ? ", fresh evidence" : "";
+        return {
+            outcome: "verified",
+            satisfied: true,
+            detail: `${REQUIRED_CHECKS_PRESENTATION_COPY.verified.detail} ` +
+                `(${supervisor.required_checks_count} required check(s) configured${fresh})`,
+        };
+    }
+    if (verdict === "unknown_name") {
+        return {
+            outcome: "unknown_name",
+            satisfied: false,
+            ...REQUIRED_CHECKS_PRESENTATION_COPY.unknown_name,
+        };
+    }
+    return {
+        outcome: "unverifiable",
+        satisfied: false,
+        ...REQUIRED_CHECKS_PRESENTATION_COPY.unverifiable,
+    };
+}
+// ---------------------------------------------------------------------------
 // Section builders
 // ---------------------------------------------------------------------------
 export function supervisorSection(readiness) {
@@ -109,20 +191,20 @@ export function supervisorSection(readiness) {
     // Deliberately its OWN section, not folded into the one above: "configured but
     // unsafe" and "not configured" drive different operator actions, and an empty
     // required-check list makes the CI gate pass unconditionally rather than fail.
-    sections.push(s.required_checks_empty
-        ? {
-            id: "supervisor-required-checks",
-            label: "Supervisor required CI checks",
-            status: "degraded",
-            detail: "required-check list is EMPTY — the done gate would pass unconditionally",
-            remediation: "bootstrap writes a non-empty required-check list into done_gate_config.",
-        }
-        : {
-            id: "supervisor-required-checks",
-            label: "Supervisor required CI checks",
-            status: "ok",
-            detail: `${s.required_checks_count} required check(s) configured`,
-        });
+    //
+    // BAPI-1254: the verdict comes from the shared `presentRequiredChecks`, the
+    // same mapping the CLI descriptor uses. Only `verified` is `ok`; a confirmed
+    // mismatch and could-not-verify are both `degraded`, never `fatal`.
+    const requiredChecks = presentRequiredChecks(s);
+    sections.push({
+        id: "supervisor-required-checks",
+        label: "Supervisor required CI checks",
+        status: requiredChecks.satisfied ? "ok" : "degraded",
+        detail: requiredChecks.detail,
+        ...(requiredChecks.remediation === undefined
+            ? {}
+            : { remediation: requiredChecks.remediation }),
+    });
     // BAPI-694 (R5) — its OWN section, and WARN-ONLY.
     //
     // `degraded`, never `fatal`: a divergence between the code_review gate's
@@ -292,7 +374,8 @@ export function mergeExecutionSections(readiness) {
                 ? `\`${MERGE_WORKFLOW_PATH}\` present`
                 : `not eligible: \`${MERGE_WORKFLOW_PATH}\` is absent`),
         fact("merge-execution-workflow-enabled", "Merge workflow enabled", m.merge_workflow_enabled, m.merge_workflow_enabled ? "enabled" : "not eligible: disabled or unknown"),
-        fact("merge-execution-workflow-version", "Merge workflow version", m.merge_workflow_version === MERGE_WORKFLOW_EXPECTED_VERSION, `\`${m.merge_workflow_version ?? "unset"}\` (expected \`${MERGE_WORKFLOW_EXPECTED_VERSION}\`)`),
+        fact("merge-execution-workflow-version", "Merge workflow version", mergeWorkflowVersionSupportsChildMerge(m.merge_workflow_version), `\`${m.merge_workflow_version ?? "unset"}\` (expected one of ` +
+            `\`${MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS.join(", ")}\`)`),
         fact("merge-execution-app-actions-write", "GitHub App `actions: write`", readiness.github.actions_write, readiness.github.actions_probe_succeeded
             ? `actions: \`${readiness.github.actions_permission_level}\``
             : "could not verify: the App permission could not be checked"),