@bridge_gpt/mcp-server 0.2.65 → 0.2.66

package/build/review-tickets.js

@@ -3,12 +3,22 @@
  *
  * Reuses the `start-tickets` terminal spawn layer directly, running reviews in
  * the current `deps.cwd`. Intentionally does NOT create Worktrunk worktrees,
- * provision MCP registrations, run venv hooks, or perform difficulty/model-tier
- * routing. One terminal tab per ticket is spawned with `/review-ticket <KEY>
- * [--auto] [--rounds=<1|2>]` as the agent prompt. `--rounds` is OMITTED by
- * default so the backend's difficulty-adaptive review policy chooses the shape;
- * it is only forwarded when the caller passes an explicit `--rounds`/`--review`
- * round override.
+ * provision MCP registrations, or run venv hooks. One terminal tab per ticket
+ * is spawned with `/review-ticket <KEY> [--auto] [--rounds=<1|2>]` as the agent
+ * prompt. `--rounds` is OMITTED by default so the backend's difficulty-adaptive
+ * review policy chooses the shape; it is only forwarded when the caller passes
+ * an explicit `--rounds`/`--review` round override.
+ *
+ * BAPI-1343 — review-threshold model routing for spawned tabs: an explicit
+ * `--model` always wins and no tier lookup is made. Otherwise each ticket's
+ * `/tickets/{n}/model-tier?consumer=review` is fetched (the shared bounded
+ * `start-tickets` fetcher, at most 3 at once), and a tab gets `--model` only
+ * when the server echoes `consumer: "review"` and reports a threshold-decided
+ * (`configured` or `anomaly`) tier, mapped to an alias exactly as
+ * `start-tickets` maps it. Legacy mode, a failed or timed-out lookup, or an
+ * older server that does not echo the consumer passes no `--model` (today's
+ * behavior); there is no premium fallback. `--dry-run` makes no lookup, and the
+ * epic-dispatch path below is not re-routed.
  *
  * Optionally supports a supervisor-driven epic-dispatch path: when an
  * `EpicDispatchIdentity` is threaded through `ReviewTicketsOptions.epic`, each
@@ -18,7 +28,7 @@
  * This path is worktree-free and base-branch-free; the human CLI path leaves
  * `epic` unset and retains byte-for-byte identical behavior.
  */
-import { createDefaultStartTicketsDeps, detectTerminal, runWithConcurrency, buildAgentInvocation, shSquoteInner, powershellSquote, isCommandOnPath, resolveFirstCommandOnPath, tmuxSessionNameForTicket, TICKET_KEY_PATTERN, DEFAULT_MAX_PARALLEL, validateBranchName, fetchAndResolveBaseSha, fetchStartTicketsConfigField, resolveStartTicketsBridgeApiAccess, buildCommandProvisioningDeps, buildMcpProvisioningDeps, } from "./start-tickets.js";
+import { createDefaultStartTicketsDeps, detectTerminal, runWithConcurrency, buildAgentInvocation, shSquoteInner, powershellSquote, isCommandOnPath, resolveFirstCommandOnPath, tmuxSessionNameForTicket, TICKET_KEY_PATTERN, DEFAULT_MAX_PARALLEL, validateBranchName, fetchAndResolveBaseSha, fetchStartTicketsConfigField, resolveStartTicketsBridgeApiAccess, buildCommandProvisioningDeps, buildMcpProvisioningDeps, fetchTicketModelTiersForKeys, isThresholdDecidedTierResponse, normalizeDifficultyModelTierOverrides, fetchCodexModelCatalog, resolveRoutingAlias, validateResolvedModelAliasForAgent, } from "./start-tickets.js";
 import { provisionCommandsForWorktree } from "./command-provisioning.js";
 import { resolveCodexLaunchScope } from "./codex-launch-scope.js";
 import { WINDOWS_TERMINAL_COMMAND, WINDOWS_POWERSHELL_CANDIDATES, TMUX_COMMAND, isSupportedStartTicketsPlatform, unsupportedPlatformMessage, } from "./start-tickets-prereqs.js";
@@ -48,7 +58,7 @@ export function getReviewTicketsUsage() {
         "  --rounds=1|2                      Review depth: 1=single-pass, 2=full two-pass (default: adaptive — backend routes by difficulty)",
         "  --review KEY=auto,rounds=1        Per-ticket review mode override (repeatable)",
         "  --agent claude|cursor-agent|codex Agent command to launch in each tab (default: claude)",
-        "  --model VALUE                     Model alias to pass as --model to the agent (optional passthrough)",
+        "  --model VALUE                     Model alias for every tab (always wins). Unset: each tab is routed by the review threshold; legacy mode or an older server passes no --model",
         "  --max-parallel N                  Max tabs to spawn concurrently (default: 3)",
         "  --dry-run                         Print intended commands; creates no tabs and opens no sessions",
         "  --base-branch BRANCH              Base branch to fetch+pin for grounding (default: config base_branch, else \"main\")",
@@ -527,12 +537,125 @@ export function buildReviewPlanRows(deps, options, agent, status, overrides = {}
             rounds: mode.rounds,
             agentName: options.agentName,
             modelAlias: options.modelAlias,
+            // BAPI-1343: plan rows (the dry-run preview) never perform a tier lookup;
+            // they show only an explicit --model, or the agent default.
+            ...(!options.epic && options.modelAlias ? { modelRoutingReason: "explicit" } : {}),
             status,
             command,
             runId,
         };
     });
 }
+/**
+ * BAPI-1343 — resolve each spawned tab's model from the review threshold.
+ *
+ * One `/model-tier?consumer=review` request per key through the shared
+ * `start-tickets` fetcher (bounded at 3, never throws). A tab is routed only
+ * when the server echoes `consumer: "review"` AND reports a threshold-decided
+ * tier; the tier maps to an alias exactly as `start-tickets` maps it (registry
+ * plus `difficulty_model_tier_overrides`, read once per batch; the Codex
+ * catalog, fetched once per batch; `validateResolvedModelAliasForAgent`, run
+ * at most once per distinct alias per batch). Every other outcome returns
+ * `modelAlias: null` (no `--model`, today's behavior) — there is no premium
+ * fallback. Callers handle explicit `--model`, `--dry-run`, and epic dispatch
+ * before calling this, so it always performs lookups.
+ */
+export async function resolveReviewModelRoutingForKeys(deps, keys, agent, maxParallel) {
+    const decisions = new Map();
+    const noModel = (reason) => ({ modelAlias: null, reason });
+    let accessResult;
+    try {
+        accessResult = await resolveStartTicketsBridgeApiAccess(deps);
+    }
+    catch {
+        for (const key of keys)
+            decisions.set(key, noModel("lookup-failed"));
+        return decisions;
+    }
+    if (!accessResult.ok) {
+        for (const key of keys)
+            decisions.set(key, noModel("lookup-failed"));
+        return decisions;
+    }
+    const access = accessResult.access;
+    const tierMap = await fetchTicketModelTiersForKeys(access, keys, maxParallel, { consumer: "review" });
+    // Batch-scoped alias inputs, loaded lazily so a batch with no
+    // threshold-decided ticket makes no config/catalog request.
+    let aliasInputs = null;
+    const loadAliasInputs = () => {
+        if (!aliasInputs) {
+            aliasInputs = (async () => {
+                try {
+                    if (agent.name === "codex") {
+                        const catalogResult = await fetchCodexModelCatalog(access);
+                        return catalogResult.ok ? { overrides: null, catalog: catalogResult.catalog } : null;
+                    }
+                    const raw = await fetchStartTicketsConfigField(access, "difficulty_model_tier_overrides");
+                    return { overrides: normalizeDifficultyModelTierOverrides(raw), catalog: null };
+                }
+                catch {
+                    return null;
+                }
+            })();
+        }
+        return aliasInputs;
+    };
+    const validations = new Map();
+    const validateOnce = (alias) => {
+        let pending = validations.get(alias);
+        if (!pending) {
+            pending = validateResolvedModelAliasForAgent(deps, agent, alias).catch(() => ({ ok: false, warning: "model validation failed" }));
+            validations.set(alias, pending);
+        }
+        return pending;
+    };
+    for (const key of keys) {
+        const result = tierMap.get(key);
+        if (!result || !result.ok) {
+            decisions.set(key, noModel("lookup-failed"));
+            continue;
+        }
+        const value = result.value;
+        if (value.consumer !== "review") {
+            decisions.set(key, noModel("consumer-unrecognized"));
+            continue;
+        }
+        if (value.source === "fallback") {
+            // The server could not obtain a difficulty; its premium tier is a guess,
+            // and review routing has no premium fallback.
+            decisions.set(key, noModel("lookup-failed"));
+            continue;
+        }
+        if (!isThresholdDecidedTierResponse(value)) {
+            decisions.set(key, noModel("legacy"));
+            continue;
+        }
+        if (!value.tier) {
+            decisions.set(key, noModel("lookup-failed"));
+            continue;
+        }
+        if (!agent.supportsModelOverride) {
+            decisions.set(key, noModel("alias-unresolved"));
+            continue;
+        }
+        const inputs = await loadAliasInputs();
+        const candidate = inputs ? resolveRoutingAlias(agent, value.tier, inputs.overrides, inputs.catalog) : null;
+        if (!candidate) {
+            decisions.set(key, noModel("alias-unresolved"));
+            continue;
+        }
+        const validation = await validateOnce(candidate);
+        if (!validation.ok) {
+            decisions.set(key, noModel("alias-unresolved"));
+            continue;
+        }
+        decisions.set(key, {
+            modelAlias: validation.alias,
+            reason: value.thresholdMode === "anomaly" ? "review-threshold:anomaly" : "review-threshold:configured",
+        });
+    }
+    return decisions;
+}
 /** Build a dry-run preview base context from parsed CLI options only — never fetches. */
 function previewBaseContextFromOptions(options) {
     if (options.noRefreshBase)
@@ -590,10 +713,25 @@ export async function orchestrateReviewTickets(deps, options, overrides = {}) {
         return { ok: false, error: baseContextResult.error };
     }
     const baseContext = baseContextResult.context;
+    // BAPI-1343: per-tab review-threshold routing for the human CLI path only.
+    // An explicit --model wins with no lookup; the epic-dispatch path keeps its
+    // pre-feature shape (Epic workers take their tier from the stamped payload).
+    let routing = null;
+    if (!options.epic) {
+        if (options.modelAlias) {
+            routing = new Map(options.keys.map((key) => [key, { modelAlias: options.modelAlias ?? null, reason: "explicit" }]));
+        }
+        else {
+            routing = await resolveReviewModelRoutingForKeys(deps, options.keys, agent, options.maxParallel);
+        }
+    }
     const terminal = detectTerminal(undefined, deps.env);
     const rows = await runWithConcurrency(options.keys, options.maxParallel, async (key) => {
         const mode = resolveEffectiveReviewMode(key, options);
-        const baseShellCommand = buildReviewAgentShellCommand(agent, key, mode, deps.platform, deps.cwd, options.modelAlias, baseContext, codexLaunchArgs);
+        const decision = routing?.get(key);
+        const modelAlias = decision ? decision.modelAlias : options.modelAlias;
+        const reasonField = decision ? { modelRoutingReason: decision.reason } : {};
+        const baseShellCommand = buildReviewAgentShellCommand(agent, key, mode, deps.platform, deps.cwd, modelAlias, baseContext, codexLaunchArgs);
         let shellCommand = baseShellCommand;
         let runId;
         if (options.epic) {
@@ -608,7 +746,8 @@ export async function orchestrateReviewTickets(deps, options, overrides = {}) {
                         auto: mode.auto,
                         rounds: mode.rounds,
                         agentName: options.agentName,
-                        modelAlias: options.modelAlias,
+                        modelAlias,
+                        ...reasonField,
                         status: "spawn-failed",
                         command: shellCommand,
                         runId,
@@ -625,7 +764,8 @@ export async function orchestrateReviewTickets(deps, options, overrides = {}) {
                         auto: mode.auto,
                         rounds: mode.rounds,
                         agentName: options.agentName,
-                        modelAlias: options.modelAlias,
+                        modelAlias,
+                        ...reasonField,
                         status: "already-dispatched",
                         command: shellCommand,
                         runId,
@@ -645,7 +785,8 @@ export async function orchestrateReviewTickets(deps, options, overrides = {}) {
                     auto: mode.auto,
                     rounds: mode.rounds,
                     agentName: options.agentName,
-                    modelAlias: options.modelAlias,
+                    modelAlias,
+                    ...reasonField,
                     status: "spawned",
                     command: shellCommand,
                     runId,
@@ -687,9 +828,11 @@ export function formatReviewTicketsSummaryReport(rows) {
     const lines = ["Summary:"];
     for (const row of rows) {
         const modelPart = row.modelAlias ? row.modelAlias : "default";
+        // BAPI-1343: the closed, secret-free routing reason, when one was recorded.
+        const modelReasonPart = row.modelRoutingReason ? `  model_reason=${row.modelRoutingReason}` : "";
         const roundsPart = row.rounds !== undefined ? String(row.rounds) : "adaptive";
         const runIdPart = row.runId ? `  run_id=${row.runId}` : "";
-        lines.push(`${row.key}  auto=${row.auto}  rounds=${roundsPart}  agent=${row.agentName}  model=${modelPart}  status=${row.status}${runIdPart}`);
+        lines.push(`${row.key}  auto=${row.auto}  rounds=${roundsPart}  agent=${row.agentName}  model=${modelPart}${modelReasonPart}  status=${row.status}${runIdPart}`);
     }
     const failedRows = rows.filter((r) => r.status === "spawn-failed" || r.status === "already-dispatched");
     if (failedRows.length > 0) {

package/build/setup-epic.js

@@ -78,7 +78,8 @@
 import { readFile as fsReadFile, stat as fsStat } from "node:fs/promises";
 import os from "node:os";
 import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, } from "./epic-integration-pr.js";
-import { approveEpicPlan, buildConductorJiraUrl, conductorGetHeaders, createEpicRunWithDisposition, decodeCanonicalProvenance, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, resolveEpicLaunchBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
+import { approveEpicPlan, buildConductorJiraUrl, conductorGetHeaders, createEpicRunWithDisposition, decodeCanonicalProvenance, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, resolveEpicLaunchBridgeApiAccess, safeDiagnosticMessage, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
+import { formatEpicLaunchChannelIdentity, getPinnedEpicLaunchPolicy, readEpicLaunchProfile, } from "./epic-launch-profile.js";
 // BAPI-1133 (A2) — the single legacy-to-typed merge-execution-mode mapping and
 // its total legacy resolver live in `merge-pull-request.ts` (no import cycle:
 // that module never imports from `setup-epic.ts`). Reused here rather than
@@ -1117,6 +1118,24 @@ function findCycle(keys, adjacency) {
     }
     return null;
 }
+export function effectivePolicyFacts(policy, source) {
+    const object = policy && typeof policy === "object" && !Array.isArray(policy)
+        ? policy : {};
+    const numbers = (value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return null;
+        const entries = Object.entries(value).filter(([key, item]) => /^[a-z][a-z0-9_]{0,63}$/.test(key) && typeof item === "number" && Number.isFinite(item));
+        return entries.length ? Object.fromEntries(entries) : null;
+    };
+    return {
+        source,
+        serial_execution: "serial",
+        posture: object.posture === "unattended" ? "unattended" : "attended",
+        caps: numbers(object.caps),
+        job_timeouts: numbers(object.job_timeouts),
+        escalation_channel: formatEpicLaunchChannelIdentity(source === "stored" ? "unavailable" : policyDeclaresNotifyWebhook(object) ? "configured webhook" : "account email"),
+    };
+}
 /** Propose a conductor epic feature branch name for an epic key (BAPI-655). */
 export function proposeFeatureBranchName(epicKey) {
     return `epic/${epicKey}`;
@@ -1561,12 +1580,7 @@ composesDefaultPolicy = true) {
         `(pass --feature-branch to force ${proposeFeatureBranchName(opts.epicKey)} anyway)`);
 }
 function errorDetail(err) {
-    if (err instanceof ConductorBridgeApiError) {
-        const status = err.status !== undefined ? ` (HTTP ${err.status})` : "";
-        const preview = err.bodyPreview ? `: ${err.bodyPreview}` : "";
-        return `${err.message}${status}${preview}`;
-    }
-    return err instanceof Error ? err.message : String(err);
+    return safeDiagnosticMessage(err, "operation failed");
 }
 /**
  * Reconcile a policy file against a REUSED run's stored policy, applying it only
@@ -1588,11 +1602,13 @@ async function applyReusedRunPolicy(args) {
     });
     if (outcome.kind === "noop") {
         args.result.policy_applied = "noop";
+        args.result.effective_policy = effectivePolicyFacts(args.storedPolicy, "stored");
         args.say("Policy:     policy unchanged");
         return true;
     }
     if (outcome.kind === "refused_divergent") {
         args.result.policy_applied = "refused_divergent";
+        args.result.effective_policy = effectivePolicyFacts(args.storedPolicy, "stored");
         args.deps.errorLog(`Epic run ${args.epicRunId} is live and its stored policy differs from the ` +
             `policy file. setup-epic will not silently change a running epic's policy.\n` +
             `${outcome.diffLines.join("\n")}\n` +
@@ -1605,10 +1621,12 @@ async function applyReusedRunPolicy(args) {
     }
     catch (err) {
         args.result.policy_applied = "refused_divergent";
+        args.result.effective_policy = effectivePolicyFacts(args.storedPolicy, "stored");
         args.deps.errorLog(`Failed to replace the run policy: ${errorDetail(err)}`);
         return false;
     }
     args.result.policy_applied = "replaced";
+    args.result.effective_policy = effectivePolicyFacts(args.requestedPolicy, "explicit");
     args.say("Policy:     policy applied: replaced");
     for (const line of outcome.diffLines)
         args.say(line);
@@ -1860,12 +1878,13 @@ function describeScopeTransition(state, status) {
  * {@link runSetupEpicCli} in every observable way — same output, same refusals,
  * same exit codes — and differs only in what it hands back.
  */
-export async function runSetupEpicWorkflow(argv, overrides = {}) {
+export async function runSetupEpicWorkflow(argv, overrides = {}, handoff) {
     const sink = {};
-    const exitCode = await executeSetupEpic(argv, overrides, sink);
+    const exitCode = await executeSetupEpic(argv, overrides, sink, handoff);
     return {
         exitCode,
         ...(sink.epicRunId !== undefined ? { epicRunId: sink.epicRunId } : {}),
+        ...(sink.epicRunId !== undefined ? { runExists: true } : {}),
     };
 }
 /**
@@ -1875,7 +1894,7 @@ export async function runSetupEpicWorkflow(argv, overrides = {}) {
 export async function runSetupEpicCli(argv, overrides = {}) {
     return (await runSetupEpicWorkflow(argv, overrides)).exitCode;
 }
-async function executeSetupEpic(argv, overrides, runIdSink) {
+async function executeSetupEpic(argv, overrides, runIdSink, handoff) {
     const deps = { ...createDefaultSetupEpicDeps(), ...overrides };
     const parsed = parseSetupEpicArgs(argv);
     if (parsed.status === "help") {
@@ -1891,6 +1910,14 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
     const opts = parsed.options;
     // With --json, stdout carries the single result object and nothing else.
     const say = opts.json ? deps.errorLog : deps.log;
+    if (handoff && (handoff.access.baseUrl !== handoff.selection.baseUrl ||
+        handoff.access.repoName !== handoff.selection.repoName ||
+        (opts.baseUrl !== undefined && opts.baseUrl !== handoff.selection.baseUrl) ||
+        (opts.repo !== undefined && opts.repo !== handoff.selection.repoName) ||
+        (opts.launchProfile !== undefined && opts.launchProfile !== handoff.selection.profileName))) {
+        deps.errorLog("setup-epic REFUSED (selection-conflict): delegated target or repository disagrees with the pinned launch selection.");
+        return 1;
+    }
     // --- Read + validate the plan sidecar (no network yet) -------------------
     let raw;
     try {
@@ -1922,18 +1949,137 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         return 1;
     }
     const localHash = hashPlan(plan);
+    // Resolve the selected target and live-run identity before choosing a policy.
+    // The offline local-only path keeps its no-network contract.
+    let access;
+    let selectedProfilePolicyPath = handoff?.profile?.policyRef?.path;
+    if (opts.localOnly && !handoff) {
+        const profileName = opts.launchProfile ?? deps.env.BAPI_EPIC_LAUNCH_PROFILE?.trim();
+        if (profileName) {
+            const profileRead = await readEpicLaunchProfile(profileName, {
+                env: deps.env,
+                homedir: deps.homedir,
+                readFile: deps.readFile,
+                host: os.hostname(),
+            });
+            if (!profileRead.ok) {
+                deps.errorLog(profileRead.message);
+                return 1;
+            }
+            selectedProfilePolicyPath = profileRead.profile.policyRef?.path;
+        }
+    }
+    let existingRunId = null;
+    let existingStatus = null;
+    let existingBaseBranch = null;
+    let existingReviewPolicy = null;
+    // BAPI-754: the live run's SERVER-REDACTED stored policy, kept for the reuse
+    // comparison. Redacted is the only form a client can ever see.
+    let existingPolicyJson = null;
+    if (!opts.localOnly) {
+        // --- Resolve access ------------------------------------------------------
+        // BAPI-1260: a caller that selected the epic-launch contract (drive-epic
+        // forwards --launch-profile / --base-url) gets the target-first resolver and
+        // the bound credential; the legacy resolver is kept byte-for-byte otherwise.
+        const accessDeps = {
+            env: deps.env,
+            cwd: deps.cwd,
+            homedir: deps.homedir,
+            platform: deps.platform,
+            readFile: deps.readFile,
+            stat: deps.stat,
+            repoName: opts.repo,
+        };
+        const accessResult = handoff
+            ? { ok: true, access: handoff.access, profile: handoff.profile }
+            : opts.launchProfile !== undefined || opts.baseUrl !== undefined || Boolean(deps.env.BAPI_EPIC_LAUNCH_PROFILE?.trim())
+                ? await resolveEpicLaunchBridgeApiAccess({
+                    ...(opts.launchProfile ? { profileName: opts.launchProfile } : {}),
+                    ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
+                }, accessDeps)
+                : await resolveConductorBridgeApiAccess(accessDeps);
+        if (!accessResult.ok) {
+            deps.errorLog(`Cannot reach the Bridge API: ${accessResult.error}`);
+            return 1;
+        }
+        access = accessResult.access;
+        say(`Epic:       ${opts.epicKey}`);
+        say(`Repo:       ${access.repoName}`);
+        say(`Plan:       v${plan.plan_version}, ${plan.nodes.length} node(s), ${plan.edges.length} edge(s)`);
+        say(`Local hash: ${localHash}`);
+        for (const w of warnings)
+            say(`  [warn] ${w}`);
+        selectedProfilePolicyPath = "profile" in accessResult
+            ? accessResult.profile?.policyRef?.path
+            : undefined;
+        // --- Step 0: pre-check ---------------------------------------------------
+        // Never create on an ambiguous read. A wrong answer here mints a duplicate run.
+        try {
+            const state = await fetchEpicRunState(access, opts.epicKey, deps.fetch);
+            existingRunId = state.epic_run?.epic_run_id ?? null;
+            existingStatus = state.epic_run?.status ?? null;
+            const existingPolicy = state.epic_run?.policy_json;
+            existingPolicyJson = existingPolicy ?? null;
+            const existingBase = existingPolicy && typeof existingPolicy === "object"
+                ? existingPolicy.base_branch
+                : undefined;
+            existingBaseBranch = typeof existingBase === "string" && existingBase.trim() !== ""
+                ? existingBase
+                : null;
+            // BAPI-679: read the existing run's review policy for the conflict guard
+            // below. Absent/malformed reads as null — "the resolver's default applies" —
+            // which is deliberately NOT the same as an explicitly selected source.
+            const existingReview = existingPolicy && typeof existingPolicy === "object"
+                ? existingPolicy.review_policy
+                : undefined;
+            const existingReviewSource = existingReview && typeof existingReview === "object"
+                ? existingReview.source
+                : undefined;
+            existingReviewPolicy =
+                typeof existingReviewSource === "string" && existingReviewSource.trim() !== ""
+                    ? existingReviewSource
+                    : null;
+        }
+        catch (err) {
+            if (err instanceof ConductorBridgeApiError && err.status === 404) {
+                existingRunId = null; // No live run — the normal first-run path.
+            }
+            else if (err instanceof ConductorBridgeApiError && err.status === 409) {
+                deps.errorLog(`Epic ${opts.epicKey} has MULTIPLE active runs — it is wedged, and every ` +
+                    `plan call will keep failing. Abandon the duplicate before retrying:\n` +
+                    `  epic-implementer abandon-run --epic-run-id <duplicate_epic_run_id>\n` +
+                    `Detail: ${errorDetail(err)}`);
+                return 1;
+            }
+            else {
+                deps.errorLog(`Could not read the epic run state, so creating one would risk a duplicate ` +
+                    `(which wedges the epic permanently). Refusing to continue.\n` +
+                    `Detail: ${errorDetail(err)}`);
+                return 1;
+            }
+        }
+    }
     // --- Read the policy file (still no network) ------------------------------
     // BAPI-754: parsed here so a malformed file, or a contradiction between the
     // file and the CLI flags, fails before credentials are resolved or any request
     // is dispatched.
     let filePolicy;
-    if (opts.policyFile !== undefined) {
-        const policyRead = await readSetupEpicPolicyFile(opts.policyFile, deps.readFile);
-        if (!policyRead.ok) {
-            deps.errorLog(policyRead.error);
-            return 1;
+    const selectedPolicyPath = opts.policyFile ?? (existingRunId === null ? selectedProfilePolicyPath : undefined);
+    const selectedPolicySource = existingRunId !== null
+        ? "stored" : opts.policyFile !== undefined ? "explicit" : selectedProfilePolicyPath !== undefined ? "profile" : "default";
+    if (selectedPolicyPath !== undefined) {
+        const pinned = handoff ? getPinnedEpicLaunchPolicy(handoff.selection) : undefined;
+        if (pinned !== undefined) {
+            filePolicy = pinned;
+        }
+        else {
+            const policyRead = await readSetupEpicPolicyFile(selectedPolicyPath, deps.readFile);
+            if (!policyRead.ok) {
+                deps.errorLog(policyRead.error);
+                return 1;
+            }
+            filePolicy = policyRead.policy;
         }
-        filePolicy = policyRead.policy;
     }
     const policyDeclaresBranch = filePolicy !== undefined &&
         ["base_branch", "baseBranch"].some((key) => key in filePolicy && filePolicy[key] !== undefined && filePolicy[key] !== null);
@@ -1963,7 +2109,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
     const policyGate = preflightSetupEpicPolicy({
         intoBase: opts.intoBase,
         attended: opts.attended,
-        policyFile: opts.policyFile,
+        policyFile: selectedPolicyPath,
         filePolicy,
         policyDeclaresBranch,
         featureBranch,
@@ -2001,42 +2147,14 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 plan_version: plan.plan_version,
                 local_plan_hash: localHash,
                 server_validated: false,
+                feature_branch: opts.intoBase ? null : resolveEffectiveFeatureBranch(featureBranch, policyGate.policy) ?? null,
                 policy_applied: "absent",
+                effective_policy: effectivePolicyFacts(policyGate.policy, selectedPolicySource),
                 warnings,
             }, null, 2));
         }
         return 0;
     }
-    // --- Resolve access ------------------------------------------------------
-    // BAPI-1260: a caller that selected the epic-launch contract (drive-epic
-    // forwards --launch-profile / --base-url) gets the target-first resolver and
-    // the bound credential; the legacy resolver is kept byte-for-byte otherwise.
-    const accessDeps = {
-        env: deps.env,
-        cwd: deps.cwd,
-        homedir: deps.homedir,
-        platform: deps.platform,
-        readFile: deps.readFile,
-        stat: deps.stat,
-        repoName: opts.repo,
-    };
-    const accessResult = opts.launchProfile !== undefined || opts.baseUrl !== undefined
-        ? await resolveEpicLaunchBridgeApiAccess({
-            ...(opts.launchProfile ? { profileName: opts.launchProfile } : {}),
-            ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
-        }, accessDeps)
-        : await resolveConductorBridgeApiAccess(accessDeps);
-    if (!accessResult.ok) {
-        deps.errorLog(`Cannot reach the Bridge API: ${accessResult.error}`);
-        return 1;
-    }
-    const access = accessResult.access;
-    say(`Epic:       ${opts.epicKey}`);
-    say(`Repo:       ${access.repoName}`);
-    say(`Plan:       v${plan.plan_version}, ${plan.nodes.length} node(s), ${plan.edges.length} edge(s)`);
-    say(`Local hash: ${localHash}`);
-    for (const w of warnings)
-        say(`  [warn] ${w}`);
     // --- Branch strategy (BAPI-1009) ----------------------------------------
     // Already resolved above, before the network was touched. Reported HERE, ahead
     // of any secondary policy detail, because it is the one decision that changes
@@ -2093,6 +2211,11 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
             reviewPolicy: opts.reviewPolicy,
             mergeExecutionMode: declaredMergeExecutionMode,
         });
+    const selectedEffectivePolicyFacts = effectivePolicyFacts(existingRunId !== null ? existingPolicyJson : composedForCreate, selectedPolicySource);
+    say(`Policy:     effective ${selectedEffectivePolicyFacts.source}; serial execution; ` +
+        `caps ${selectedEffectivePolicyFacts.caps ? JSON.stringify(selectedEffectivePolicyFacts.caps) : "unavailable"}; ` +
+        `timeouts ${selectedEffectivePolicyFacts.job_timeouts ? JSON.stringify(selectedEffectivePolicyFacts.job_timeouts) : "unavailable"}; ` +
+        `channel ${selectedEffectivePolicyFacts.escalation_channel}`);
     // BAPI-1133 (A2). Reported only when THIS command stamped the key — i.e. it
     // is present in the composed policy and was absent from whatever the
     // operator supplied — as low-emphasis policy metadata, mirroring the
@@ -2128,59 +2251,6 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         say(`Feature:    ${effectiveFeatureBranch} (from the policy file; cut on origin with local ` +
             `git at the canonical indexed commit; validated server-side at approval)`);
     }
-    // --- Step 0: pre-check ---------------------------------------------------
-    // Never create on an ambiguous read. A wrong answer here mints a duplicate run.
-    let existingRunId = null;
-    let existingStatus = null;
-    let existingBaseBranch = null;
-    let existingReviewPolicy = null;
-    // BAPI-754: the live run's SERVER-REDACTED stored policy, kept for the reuse
-    // comparison. Redacted is the only form a client can ever see.
-    let existingPolicyJson = null;
-    try {
-        const state = await fetchEpicRunState(access, opts.epicKey, deps.fetch);
-        existingRunId = state.epic_run?.epic_run_id ?? null;
-        existingStatus = state.epic_run?.status ?? null;
-        const existingPolicy = state.epic_run?.policy_json;
-        existingPolicyJson = existingPolicy ?? null;
-        const existingBase = existingPolicy && typeof existingPolicy === "object"
-            ? existingPolicy.base_branch
-            : undefined;
-        existingBaseBranch = typeof existingBase === "string" && existingBase.trim() !== ""
-            ? existingBase
-            : null;
-        // BAPI-679: read the existing run's review policy for the conflict guard
-        // below. Absent/malformed reads as null — "the resolver's default applies" —
-        // which is deliberately NOT the same as an explicitly selected source.
-        const existingReview = existingPolicy && typeof existingPolicy === "object"
-            ? existingPolicy.review_policy
-            : undefined;
-        const existingReviewSource = existingReview && typeof existingReview === "object"
-            ? existingReview.source
-            : undefined;
-        existingReviewPolicy =
-            typeof existingReviewSource === "string" && existingReviewSource.trim() !== ""
-                ? existingReviewSource
-                : null;
-    }
-    catch (err) {
-        if (err instanceof ConductorBridgeApiError && err.status === 404) {
-            existingRunId = null; // No live run — the normal first-run path.
-        }
-        else if (err instanceof ConductorBridgeApiError && err.status === 409) {
-            deps.errorLog(`Epic ${opts.epicKey} has MULTIPLE active runs — it is wedged, and every ` +
-                `plan call will keep failing. Abandon the duplicate before retrying:\n` +
-                `  epic-implementer abandon-run --epic-run-id <duplicate_epic_run_id>\n` +
-                `Detail: ${errorDetail(err)}`);
-            return 1;
-        }
-        else {
-            deps.errorLog(`Could not read the epic run state, so creating one would risk a duplicate ` +
-                `(which wedges the epic permanently). Refusing to continue.\n` +
-                `Detail: ${errorDetail(err)}`);
-            return 1;
-        }
-    }
     // --- Feature-branch conflict guard against an existing live run ----------
     // A selected branch that disagrees with the existing run's stored base branch
     // must fail closed rather than patch or silently change that run. A matching
@@ -2508,6 +2578,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 // "absent"; server_validated says whether the check was authoritative.
                 server_validated: validated !== null,
                 policy_applied: "absent",
+                effective_policy: selectedEffectivePolicyFacts,
                 ...(validated
                     ? {
                         server_plan_hash: validated.planHash,
@@ -2579,6 +2650,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         plan_approved: false,
         server_validated: validated !== null,
         policy_applied: "absent",
+        effective_policy: selectedEffectivePolicyFacts,
         warnings,
     };
     // BAPI-850: the EFFECTIVE feature branch (flag or policy file), so a
@@ -3128,14 +3200,14 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         else {
             say("The server-side reconciler will pick it up within ~30s.");
         }
-        // BAPI-1102 — the executor command is printed WITH a claim scope. Since
-        // BAPI-1026 an executor started with no scope REFUSES TO START, so the
-        // unscoped form printed here was guidance that could not work: an operator
-        // who copied it got a startup error, and the natural reading of that error is
-        // that the run is broken rather than that the instruction was.
-        say("To execute this run's claimed jobs on this machine, run:");
-        say(`  npx -y ${MCP_PACKAGE_NAME} executor --repo ${access.repoName} ` +
-            `--epic-run-id ${result.epic_run_id}`);
+        if (handoff) {
+            say("The launcher starts or reuses the executor appropriate for this run.");
+        }
+        else {
+            say("To execute this run's claimed jobs on this machine, run:");
+            say(`  npx -y ${MCP_PACKAGE_NAME} executor --repo ${access.repoName} ` +
+                `--epic-run-id ${result.epic_run_id}`);
+        }
     }
     return exitCode;
 }