@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/conductor/epic-implementer-cli.js

@@ -57,18 +57,21 @@ export function getConductorUsage() {
     return [
         "Usage: epic-implementer <command> [options]",
         "",
-        "Local append-only event ledger for multi-agent coordination.",
-        "Talks ONLY to the local SQLite store (~/.config/bridge/events.db); no Bridge API calls.",
+        "Local append-only event ledger for multi-agent coordination, plus run-control",
+        "commands. The ledger commands talk ONLY to the local SQLite store",
+        "(~/.config/bridge/events.db); the run-control commands (stop-run through",
+        "rerun-ci), epic-status, and readiness call the Bridge API.",
         "",
         "Commands:",
         "  emit-event           Append one semantic event to the ledger",
         "  supervise --run-id <id>  Run the foreground, run-scoped supervisor loop",
-        "  epic-tick            Run one stateless reconciliation pass for an Epic",
+        "  epic-tick            RETIRED (v1): always exits 1 with EPIC_TICK_V1_FROZEN; the",
+        "                       server-side reconciler replaced it",
         "  epic-status          Print read-only health summary of an Epic Run",
         "  send-message         Enqueue ONE typed supervisor->worker relay message (idempotent)",
         "  check-messages       Read + ACK pending relay messages for a worker (no redelivery)",
         "  doctor               Read-only health/diagnostics report (ledger + git hooks)",
-        "  readiness            Read-only ADVISORY report of every conductor prerequisite",
+        "  readiness            Read-only ADVISORY report of every Epic Implementer prerequisite",
         "                       (install + epic-implementer doctor + plane preflight + server),",
         "                       each with pass/warn/fail/skip and one named remediation.",
         "                       Remediations are NOT run automatically; always exits 0.",
@@ -112,6 +115,13 @@ export function getConductorUsage() {
         "  continuation-receipt --epic-run-id <id> --ticket-key <key> [--request-id <id>] [--json]",
         "                       Read-only: the child's current episode and whether a continuation",
         "                       request's receipt proves it committed (use after a lost response).",
+        "  resume-ci --epic-run-id <id> --ticket-key <key> [--json]",
+        "                       Resume a child parked on a qualified CI stop once CI is green: CI",
+        "                       returns to evaluation with NO new wait, job, or repair allowance.",
+        "  rerun-ci --epic-run-id <id> --ticket-key <key> --binding <token> [--json]",
+        "                       Ask CI to re-run a ticket's FAILED checks at its bound head (guided: copy",
+        "                       the command explain-run rendered). Charges NO allowance and never re-runs",
+        "                       claude-review. A re-run is not a verdict: after CI is green, use resume-ci.",
         "",
         "supervise options:",
         "  --run-id <id>             Run/session identifier to supervise (required)",
@@ -193,11 +203,11 @@ export function getConductorUsage() {
         "  epic-implementer scope-catch-up --epic-run-id <id> --scope-id <scope>",
         "      # a merge landed on epic/<KEY> that the scope never observed (unobserved_advance)",
         "  epic-implementer patch-policy --epic-run-id <id> --patch-file required-checks.json",
-        "      # required_checks_empty_no_mode; the file holds {\"required_checks\":[\"conductor-ci / gate\"]}",
+        "      # required_checks_empty_no_mode; the file holds {\"required_checks\":[\"epic-implementer-ci / gate\"]}",
         "  epic-implementer resume-run --epic-run-id <id>",
         "      # a cap_wall_clock pause whose cause is now cleared",
         "",
-        "epic-tick options:",
+        "epic-tick options (retired; parsed by no live path):",
         "  --epic-key <KEY>          Epic key to supervise (required, non-empty)",
         "  --scheduled-at <epoch>    Epoch-seconds timestamp when this tick was scheduled (optional)",
         "  --lease-ttl-seconds <n>   Lease TTL in seconds (optional, default 120)",
@@ -254,6 +264,10 @@ export function getConductorUsage() {
         "  epic-implementer continue-child --epic-run-id 3f9c2b7e-... --ticket-key BAPI-852",
         "  # The continue-child response was lost — did it commit?",
         "  epic-implementer continuation-receipt --epic-run-id 3f9c2b7e-... --ticket-key BAPI-852",
+        "  # CI finished green after the child parked on an expired CI wait:",
+        "  epic-implementer resume-ci --epic-run-id 3f9c2b7e-... --ticket-key BAPI-852",
+        "  # CI failed on infrastructure: re-run it (never claude-review); then resume-ci once green:",
+        "  epic-implementer rerun-ci --epic-run-id 3f9c2b7e-... --ticket-key BAPI-852 --binding <token>",
     ].join("\n");
 }
 /**
@@ -305,6 +319,10 @@ const VALID_COMMANDS = new Set([
     // BAPI-1300: CLI-only parked-child continuation pair — never registered as MCP tools.
     "continue-child",
     "continuation-receipt",
+    // BAPI-1326: CLI-only allowance-preserving CI resume — never an MCP tool.
+    "resume-ci",
+    // BAPI-1388: CLI-only guided provider re-run of failed CI workflow runs — never an MCP tool.
+    "rerun-ci",
     // Private, and deliberately ABSENT from the usage text: `__hook-bin` exists as
     // the bundled-artifact regression guard for BAPI-772 (mirroring `plane
     // __entrypoint`), not as a supported operator workflow.
@@ -1439,6 +1457,16 @@ export async function runEpicImplementerCli(argv) {
                 const { runContinuationReceiptCommand } = await import("./recovery-cli.js");
                 return await runContinuationReceiptCommand(parsed.argv);
             }
+            case "resume-ci": {
+                // BAPI-1326: delegates only to the pinned CI recovery operation.
+                const { runResumeCiCommand } = await import("./recovery-cli.js");
+                return await runResumeCiCommand(parsed.argv);
+            }
+            case "rerun-ci": {
+                // BAPI-1388: delegates only to the guided, pinned rerun-ci operation.
+                const { runRerunCiCommand } = await import("./recovery-cli.js");
+                return await runRerunCiCommand(parsed.argv);
+            }
             default:
                 console.error('Error: Unknown command. Run "epic-implementer --help" for usage.');
                 return 1;

package/build/conductor/errors.js

@@ -70,9 +70,10 @@ export class ConductorStoreError extends Error {
  */
 export class ConductorEpicTickV1FrozenError extends Error {
     constructor() {
-        super("The v1 `epic-implementer epic-tick` path is frozen (EPIC_TICK_V1_FROZEN). Epic " +
-            "Conductor v2 replaces the local epic tick with a server-side reconciler " +
-            "plus the local executor — run `mcp-server executor` instead.");
+        super("The v1 `epic-implementer epic-tick` path is frozen (EPIC_TICK_V1_FROZEN). The " +
+            "Epic Implementer replaced the local epic tick with a server-side reconciler " +
+            "plus the local executor — run `mcp-server executor --repo <name> " +
+            "--epic-run-id <run-id>` instead.");
         this.name = "ConductorEpicTickV1FrozenError";
     }
 }

package/build/conductor/guided-repair.js

@@ -0,0 +1,327 @@
+/**
+ * BAPI-1333 — guided operator repairs: the displayed binding and its local
+ * recovery reference.
+ *
+ * ExplainRun renders a guided command with one `--binding v1.<base64url>` token.
+ * The token names the verb, the run, and the bounded subject the command was
+ * rendered against (a run repair revision plus its control, block, or policy
+ * subject; a scope episode; or a ticket version and head). This module:
+ *
+ * - decodes and strictly validates that token (identifiers only, closed keys);
+ * - turns it into the typed `guard` the server enforces in its guarded write;
+ * - persists a small local reference BEFORE the first POST — the request id, the
+ *   binding, and digests of the binding and the payload — so a transport retry
+ *   or a restarted CLI process re-sends the SAME request instead of re-reading
+ *   the run and approving whatever subject exists now.
+ *
+ * The stored reference never holds a payload value: a policy patch or a driver
+ * context is represented only by its SHA-256 digest. Nothing here performs HTTP.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { canonicalSha256, clearRecoveryReferenceFile, readRecoveryReferenceFile, writeRecoveryReferenceFile, } from "./epic-child-continuation.js";
+export const GUIDED_BINDING_TOKEN_PREFIX = "v1.";
+export const GUIDED_REPAIR_REFERENCE_NAMESPACE = "epic-guided-repairs";
+/** The fixed message when the reference cannot be stored; nothing is sent. */
+export const GUIDED_REFERENCE_STORE_FAILED_MESSAGE = "could not store the local recovery reference, so the request was not sent";
+/** A rerun of the same displayed command with a DIFFERENT payload. */
+export const GUIDED_PAYLOAD_CONFLICT_MESSAGE = "a different request was already issued for this displayed command; nothing " +
+    "was sent. Re-read the run explanation before choosing another action";
+export const GUIDED_REPAIR_VERBS = [
+    "resume-run",
+    "patch-policy",
+    "scope-reparse",
+    "scope-catch-up",
+    "dispatch-remediation",
+    // BAPI-1388 — ticket-addressed, pinned to the same version-and-head subject as
+    // `dispatch-remediation`, and consuming the binding ExplainRun renders.
+    "rerun-ci",
+];
+/** A malformed or mismatched binding. The message never echoes the token. */
+export class GuidedBindingError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GuidedBindingError";
+    }
+}
+const TOKEN_RE = /^[a-z][a-z0-9_]{0,63}$/;
+const SHA_RE = /^[0-9a-f]{40}$/;
+const REQUEST_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const FINGERPRINT_RE = /^[0-9a-f]{64}$/;
+/** Keys each verb's token may carry, beyond `v`, `verb`, and `epic_run_id`. */
+const ALLOWED_KEYS = {
+    "resume-run": [
+        "repair_revision",
+        "subject",
+        "control_state",
+        "control_generation",
+        "block_reason",
+    ],
+    "patch-policy": ["repair_revision", "subject"],
+    "scope-reparse": ["scope_id", "lifecycle_state", "required_commit_sha"],
+    "scope-catch-up": ["scope_id", "lifecycle_state", "required_commit_sha"],
+    "dispatch-remediation": ["ticket_key", "expected_row_version", "expected_head_sha"],
+    "rerun-ci": ["ticket_key", "expected_row_version", "expected_head_sha"],
+};
+function invalid() {
+    return new GuidedBindingError("--binding is not a valid guided-repair binding; nothing was sent. Copy the " +
+        "command exactly as the run explanation rendered it.");
+}
+function nonNegativeInt(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+        throw invalid();
+    return value;
+}
+function boundedString(value, max) {
+    if (typeof value !== "string" || value.length === 0 || value.length > max)
+        throw invalid();
+    return value;
+}
+function optionalSha(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (typeof value !== "string" || !SHA_RE.test(value))
+        throw invalid();
+    return value;
+}
+function decodeBase64Url(text) {
+    if (!/^[A-Za-z0-9_-]+$/.test(text) || text.length > 2048)
+        throw invalid();
+    return Buffer.from(text, "base64url").toString("utf8");
+}
+/** Decode and strictly validate a `--binding` token. Throws {@link GuidedBindingError}. */
+export function decodeGuidedBinding(token) {
+    if (typeof token !== "string" || !token.startsWith(GUIDED_BINDING_TOKEN_PREFIX)) {
+        throw invalid();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(decodeBase64Url(token.slice(GUIDED_BINDING_TOKEN_PREFIX.length)));
+    }
+    catch (err) {
+        if (err instanceof GuidedBindingError)
+            throw err;
+        throw invalid();
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw invalid();
+    const raw = parsed;
+    if (raw.v !== 1)
+        throw invalid();
+    const verb = raw.verb;
+    if (typeof verb !== "string" || !GUIDED_REPAIR_VERBS.includes(verb)) {
+        throw invalid();
+    }
+    const guidedVerb = verb;
+    const allowed = new Set(["v", "verb", "epic_run_id", ...ALLOWED_KEYS[guidedVerb]]);
+    for (const key of Object.keys(raw)) {
+        if (!allowed.has(key))
+            throw invalid();
+    }
+    const binding = {
+        verb: guidedVerb,
+        epicRunId: boundedString(raw.epic_run_id, 200),
+    };
+    if (guidedVerb === "resume-run" || guidedVerb === "patch-policy") {
+        binding.repairRevision = nonNegativeInt(raw.repair_revision);
+        const subject = raw.subject;
+        if (guidedVerb === "patch-policy") {
+            if (subject !== "policy")
+                throw invalid();
+            binding.subject = "policy";
+        }
+        else if (subject === "control") {
+            if (raw.control_state !== "paused" && raw.control_state !== "quarantined")
+                throw invalid();
+            const generation = nonNegativeInt(raw.control_generation);
+            if (generation < 1 || raw.block_reason !== undefined)
+                throw invalid();
+            binding.subject = "control";
+            binding.controlState = raw.control_state;
+            binding.controlGeneration = generation;
+        }
+        else if (subject === "integration_block") {
+            const reason = raw.block_reason;
+            if (typeof reason !== "string" || !TOKEN_RE.test(reason))
+                throw invalid();
+            if (raw.control_state !== undefined || raw.control_generation !== undefined)
+                throw invalid();
+            binding.subject = "integration_block";
+            binding.blockReason = reason;
+        }
+        else {
+            throw invalid();
+        }
+    }
+    else if (guidedVerb === "dispatch-remediation" || guidedVerb === "rerun-ci") {
+        binding.ticketKey = boundedString(raw.ticket_key, 64);
+        binding.expectedRowVersion = nonNegativeInt(raw.expected_row_version);
+        binding.expectedHeadSha = optionalSha(raw.expected_head_sha);
+    }
+    else {
+        binding.scopeId = boundedString(raw.scope_id, 200);
+        const lifecycle = raw.lifecycle_state;
+        if (typeof lifecycle !== "string" || !TOKEN_RE.test(lifecycle))
+            throw invalid();
+        binding.lifecycleState = lifecycle;
+        binding.requiredCommitSha = optionalSha(raw.required_commit_sha);
+    }
+    return binding;
+}
+/** The canonical, snake_case identity of a binding (what its digest covers). */
+export function bindingIdentity(binding) {
+    const out = { verb: binding.verb, epic_run_id: binding.epicRunId };
+    const pairs = [
+        ["repair_revision", binding.repairRevision],
+        ["subject", binding.subject],
+        ["control_state", binding.controlState],
+        ["control_generation", binding.controlGeneration],
+        ["block_reason", binding.blockReason],
+        ["scope_id", binding.scopeId],
+        ["lifecycle_state", binding.lifecycleState],
+        ["required_commit_sha", binding.requiredCommitSha],
+        ["ticket_key", binding.ticketKey],
+        ["expected_row_version", binding.expectedRowVersion],
+        ["expected_head_sha", binding.expectedHeadSha],
+    ];
+    for (const [key, value] of pairs) {
+        if (value !== undefined)
+            out[key] = value;
+    }
+    return out;
+}
+/** The typed body `guard` for this binding and request id. */
+export function guardForBinding(binding, requestId) {
+    if (binding.verb === "resume-run" || binding.verb === "patch-policy") {
+        const guard = {
+            request_id: requestId,
+            epic_run_id: binding.epicRunId,
+            repair_revision: binding.repairRevision ?? 0,
+            subject: binding.subject ?? "policy",
+        };
+        if (binding.controlState !== undefined)
+            guard.control_state = binding.controlState;
+        if (binding.controlGeneration !== undefined)
+            guard.control_generation = binding.controlGeneration;
+        if (binding.blockReason !== undefined)
+            guard.block_reason = binding.blockReason;
+        return guard;
+    }
+    if (binding.verb === "dispatch-remediation" || binding.verb === "rerun-ci") {
+        return {
+            request_id: requestId,
+            epic_run_id: binding.epicRunId,
+            expected_row_version: binding.expectedRowVersion ?? 0,
+            expected_head_sha: binding.expectedHeadSha ?? null,
+        };
+    }
+    return {
+        request_id: requestId,
+        epic_run_id: binding.epicRunId,
+        lifecycle_state: binding.lifecycleState ?? "",
+        required_commit_sha: binding.requiredCommitSha ?? null,
+    };
+}
+function stableStringify(value) {
+    if (Array.isArray(value))
+        return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+/**
+ * SHA-256 of a request payload in canonical form (sorted keys; any JSON number).
+ * Only this digest is persisted, so a patch or context never reaches the disk.
+ */
+export function guidedPayloadDigest(payload) {
+    return createHash("sha256").update(stableStringify(payload), "utf8").digest("hex");
+}
+function referenceTarget(binding) {
+    return binding.ticketKey ?? binding.scopeId ?? "run";
+}
+function referenceKey(binding) {
+    return { epicRunId: binding.epicRunId, ticketKey: `${binding.verb}:${referenceTarget(binding)}` };
+}
+function referenceFingerprint(ref) {
+    return canonicalSha256({
+        v: 1,
+        verb: ref.verb,
+        epic_run_id: ref.epicRunId,
+        target: ref.target,
+        request_id: ref.requestId,
+        binding_digest: ref.bindingDigest,
+        payload_digest: ref.payloadDigest,
+    });
+}
+function parseReference(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const ref = raw;
+    if (ref.version !== 1)
+        return null;
+    if (typeof ref.verb !== "string" || !GUIDED_REPAIR_VERBS.includes(ref.verb)) {
+        return null;
+    }
+    for (const key of ["epicRunId", "target", "createdAt"]) {
+        if (typeof ref[key] !== "string" || ref[key].length === 0)
+            return null;
+    }
+    if (typeof ref.requestId !== "string" || !REQUEST_ID_RE.test(ref.requestId))
+        return null;
+    for (const key of ["bindingDigest", "payloadDigest", "fingerprint"]) {
+        if (typeof ref[key] !== "string" || !FINGERPRINT_RE.test(ref[key]))
+            return null;
+    }
+    const parsed = raw;
+    // A reference whose fingerprint no longer matches its own identity was
+    // tampered with or truncated; it never authorizes a re-send.
+    return referenceFingerprint(parsed) === parsed.fingerprint ? parsed : null;
+}
+/**
+ * Reuse the persisted request for this exact binding and payload, or mint and
+ * durably persist a new one BEFORE anything is sent.
+ *
+ * - Same binding, same payload → the SAME request id (transport retry, restart).
+ * - Same binding, different payload → refused locally; nothing is sent.
+ * - Different binding (a newer rendered command) → a new request replaces it.
+ */
+export async function prepareGuidedRequest(binding, payloadDigest, deps = {}) {
+    const key = referenceKey(binding);
+    const bindingDigest = canonicalSha256(bindingIdentity(binding));
+    const existing = parseReference(await readRecoveryReferenceFile(GUIDED_REPAIR_REFERENCE_NAMESPACE, key, deps.store));
+    if (existing !== null && existing.bindingDigest === bindingDigest) {
+        if (existing.payloadDigest !== payloadDigest)
+            return { kind: "payload_conflict" };
+        return { kind: "ready", requestId: existing.requestId, referenceReused: true };
+    }
+    const requestId = (deps.newRequestId ?? randomUUID)();
+    const base = {
+        version: 1,
+        verb: binding.verb,
+        epicRunId: binding.epicRunId,
+        target: referenceTarget(binding),
+        requestId,
+        bindingDigest,
+        payloadDigest,
+    };
+    const reference = {
+        ...base,
+        createdAt: (deps.now ?? (() => new Date()))().toISOString(),
+        fingerprint: referenceFingerprint(base),
+    };
+    try {
+        await writeRecoveryReferenceFile(GUIDED_REPAIR_REFERENCE_NAMESPACE, key, reference, deps.store);
+    }
+    catch {
+        return { kind: "store_failed" };
+    }
+    return { kind: "ready", requestId, referenceReused: false };
+}
+/** Remove the reference once the server returned a definitive answer. Never throws. */
+export async function clearGuidedReference(binding, deps = {}) {
+    await clearRecoveryReferenceFile(GUIDED_REPAIR_REFERENCE_NAMESPACE, referenceKey(binding), deps.store);
+}

package/build/conductor/hook-runtime-qualification.js

@@ -89,7 +89,7 @@ export const HOOK_RUNTIME_ACTIONS = {
         "from a persistent install.",
     "unqualified-runtime": "the hook runtime is not a qualified persistent installation (supported: a persistent npm " +
         `install of ${MCP_PACKAGE_NAME} ${HOOK_RUNTIME_COMPATIBLE_RANGE} on macOS or Linux with an even ` +
-        `Node LTS line >= ${HOOK_RUNTIME_MIN_NODE_MAJOR}). See mcp_server/docs/CONDUCTOR.md.`,
+        `Node LTS line >= ${HOOK_RUNTIME_MIN_NODE_MAJOR}). See mcp_server/docs/EPIC-IMPLEMENTER.md.`,
     "node-unavailable": "`node` could not be launched from PATH, so the hook cannot run. Put a qualified Node on PATH " +
         "and re-run `epic-implementer doctor`.",
     "native-unavailable": "better-sqlite3 does not load for the hook's Node, so no event can be recorded. Reinstall the " +

package/build/conductor/merge-execution-contract.js

@@ -23,14 +23,13 @@
  * inspected a local checkout to decide merge eligibility would be answering a
  * different question from the one the server's before-merge preflight answers.
  *
- * ## Deferred remedy
+ * ## Remedy command
  *
- * {@link MERGE_WORKFLOW_REMEDY_COMMAND} names the generate-and-PR command epic
- * child 4 ships. Until child 4 lands, a refusal may name a command that is not
- * yet an executable entry point on the operator's machine. That residual risk,
- * its three containments, and who owns escalation are recorded once, in the
+ * {@link MERGE_WORKFLOW_REMEDY_COMMAND} is the complete generate-and-PR command that
+ * BAPI-1136 shipped (BAPI-1376 made it a full launcher command). Its history and containments are recorded once, in the
  * Python module's docstring; this mirror does not restate them.
  */
+import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 /** The one `RunPolicy.merge_execution_mode` value this contract governs. */
 export const MERGE_EXECUTION_MODE_GITHUB_ACTIONS = "github_actions";
 /**
@@ -80,7 +79,27 @@ export function mergeWorkflowVersionSupportsIntegrationActions(version) {
         INTEGRATION_ACTION_WORKFLOW_VERSIONS.includes(version));
 }
 /**
- * The single command that generates the merge workflow and opens its pull
- * request. Every refusal, remediation, and readiness line imports this constant.
+ * The dispatched subcommand that generates the merge workflow and opens its pull
+ * request. This is the part the CLI's own dispatcher (`index.ts`) matches on
+ * (`install`), not the launcher that starts it. The Python mirror derives its
+ * command head from this value.
  */
-export const MERGE_WORKFLOW_REMEDY_COMMAND = "install-bridge conductor --merge-workflow";
+export const MERGE_WORKFLOW_SUBCOMMAND = "install conductor --merge-workflow";
+/**
+ * The complete, copy-ready command that generates the merge workflow and opens
+ * its pull request. Every refusal, remediation, and readiness line imports this
+ * constant.
+ *
+ * The package name comes from `mcp-identity.ts`, the sole source of that
+ * literal (BAPI-806). That module is itself dependency-free, so this import can
+ * never close a cycle. The `<@org/team|@user>` placeholder is deliberately NOT a valid owner — the
+ * installer refuses it — so an operator must replace it before running.
+ */
+export const MERGE_WORKFLOW_REMEDY_COMMAND = `npx -y ${MCP_PACKAGE_NAME} ${MERGE_WORKFLOW_SUBCOMMAND} --codeowner <@org/team|@user>`;
+/**
+ * One reusable instruction to print beside {@link MERGE_WORKFLOW_REMEDY_COMMAND}.
+ * Bridge cannot infer who should review the workflow file, so the placeholder
+ * must be replaced by hand.
+ */
+export const MERGE_WORKFLOW_CODEOWNER_INSTRUCTION = "Bridge cannot infer the code owner. Before running, replace <@org/team|@user> " +
+    "with the one @user or @org/team who should review the workflow file.";

package/build/conductor/merge-execution-eligibility.js

@@ -31,7 +31,7 @@
  * not eligible: it is a workflow this build has never been taught to reason
  * about, and "newer is probably fine" is a guess about a merge actuator.
  */
-import { MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS, MERGE_WORKFLOW_REMEDY_COMMAND, mergeWorkflowVersionSupportsChildMerge, } from "./merge-execution-contract.js";
+import { MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS, MERGE_WORKFLOW_CODEOWNER_INSTRUCTION, MERGE_WORKFLOW_REMEDY_COMMAND, mergeWorkflowVersionSupportsChildMerge, } from "./merge-execution-contract.js";
 /**
  * Remediation for a verdict that could not be established.
  *
@@ -51,7 +51,8 @@ export const MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION = "re-run once the Bridge
  * second way.
  */
 export const MERGE_EXECUTION_INELIGIBLE_REMEDIATION = `run \`${MERGE_WORKFLOW_REMEDY_COMMAND}\` to generate the merge workflow and open its ` +
-    "pull request, then re-run once it is merged to the default branch.";
+    `pull request. ${MERGE_WORKFLOW_CODEOWNER_INSTRUCTION} ` +
+    "Then re-run once it is merged to the default branch.";
 function unverifiable(reason, detail) {
     return {
         status: "could_not_verify",

package/build/conductor/pr-ci-producer.js

@@ -531,7 +531,7 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
 function extractTicketKeyFromRef(headRef) {
     if (!headRef)
         return null;
-    const match = /([A-Z][A-Z0-9]+-\d+)/i.exec(headRef);
+    const match = /([A-Z][A-Z0-9_]{0,19}-\d+)/i.exec(headRef);
     return match ? match[1].toUpperCase() : null;
 }
 /**

package/build/conductor/readiness-cli.js

@@ -35,15 +35,18 @@
 import os from "node:os";
 import { readFile as fsReadFile, stat as fsStat } from "node:fs/promises";
 import { collectConductorReadinessGate, formatConductorReadinessGateReport, } from "./readiness.js";
-import { resolveConductorBridgeApiAccess } from "./bridge-api-client.js";
+import { readinessEndpointEnvironments, resolveConductorBridgeApiAccess, resolveEpicLaunchBridgeApiAccess } from "./bridge-api-client.js";
+import { validateHttpBaseUrl } from "../base-url.js";
 import { claudeReviewWorkflowPath } from "../claude-review-workflow.js";
 import { runDefaultPlanePreflight } from "../plane/cli.js";
+import { planeNotApplicableForTarget } from "../plane/endpoint.js";
+import { resolvePlaneServerEndpoint } from "../plane/member-roster.js";
 /** Fixed notice emitted to stderr when a source could not be collected. */
 export const READINESS_COLLECTION_NOTICE = "one or more readiness sources could not be collected; the affected prerequisites are reported as failures.";
 /** Usage text for `epic-implementer readiness`. */
 export function getReadinessUsage() {
     return [
-        "Usage: epic-implementer readiness [--json] [--no-deny-probe]",
+        "Usage: epic-implementer readiness [--json] [--no-deny-probe] [--base-url <url>]",
         "",
         "Read-only ADVISORY report of every conductor prerequisite, consolidated from the",
         "Bridge install checklist, the epic-implementer doctor, the plane preflight, and the",
@@ -58,19 +61,31 @@ export function getReadinessUsage() {
         "  --json            Print the versioned structured report as JSON",
         "  --no-deny-probe   Accepted for parity with `epic-implementer doctor`; inert here, because",
         "                    this command never spawns the deny-enforcement probe",
+        "  --base-url <url>  Select a read-only Bridge API endpoint for this report;",
+        "                    this does not authorize or supply a credential",
         "  --help            Print this usage message",
     ].join("\n");
 }
 /** Parse `epic-implementer readiness` argv. Unknown flags and positionals are errors. */
 export function parseReadinessArgs(argv) {
     const parsed = { json: false, help: false, noDenyProbe: false };
-    for (const token of argv) {
+    for (let index = 0; index < argv.length; index++) {
+        const token = argv[index];
         if (token === "--json")
             parsed.json = true;
         else if (token === "--no-deny-probe")
             parsed.noDenyProbe = true;
         else if (token === "--help" || token === "-h")
             parsed.help = true;
+        else if (token === "--base-url") {
+            const raw = argv[++index];
+            if (!raw || raw.startsWith("--"))
+                return { error: "--base-url requires an HTTP(S) URL." };
+            const valid = validateHttpBaseUrl(raw);
+            if (!valid.ok)
+                return { error: "--base-url requires a valid HTTP(S) URL." };
+            parsed.baseUrl = valid.baseUrl;
+        }
         else
             return { error: `Unknown argument "${token}". Run "epic-implementer readiness --help" for usage.` };
     }
@@ -83,8 +98,24 @@ export function parseReadinessArgs(argv) {
  * epic-implementer doctor's local inspections, and the same plane preflight
  * `plane up` and `drive-epic` run. Nothing is re-implemented here.
  */
-async function collectProductionReport(repoRoot, env) {
-    const accessResult = await resolveConductorBridgeApiAccess({ env, cwd: repoRoot });
+async function collectProductionReport(repoRoot, env, baseUrl) {
+    const { reportEnv, resolverEnv } = readinessEndpointEnvironments(env, baseUrl);
+    const accessResult = baseUrl === undefined
+        ? await resolveConductorBridgeApiAccess({ env: reportEnv, cwd: repoRoot })
+        : await resolveEpicLaunchBridgeApiAccess({ baseUrl }, { env: resolverEnv, cwd: repoRoot });
+    // BAPI-1360: the plane checks apply only when the selected access target names
+    // the local plane. Resolved from the SAME env the plane preflight reads, through
+    // the shared leaf predicate `drive-epic` uses, and never guessed: a target that
+    // is remote, or that cannot be resolved at all, is an explicit skip.
+    const planeNotApplicable = planeNotApplicableForTarget(resolvePlaneServerEndpoint(reportEnv), accessResult.ok ? accessResult.access.baseUrl : null);
+    if (baseUrl !== undefined && !accessResult.ok) {
+        // A refused override is never permission for a downstream doctor collector
+        // to resolve credentials afresh from the general CLI environment.
+        return collectConductorReadinessGate({
+            repoName: null,
+            ...(planeNotApplicable !== null ? { planeNotApplicable } : {}),
+        });
+    }
     const access = accessResult.ok ? accessResult.access : null;
     return collectConductorReadinessGate({
         // Never guessed: an unresolved identity is reported as such rather than
@@ -101,7 +132,7 @@ async function collectProductionReport(repoRoot, env) {
             readWorkflowFile: () => fsReadFile(claudeReviewWorkflowPath(repoRoot), "utf-8"),
             projectRoot: repoRoot,
             installDoctorDeps: {
-                env,
+                env: reportEnv,
                 cwd: repoRoot,
                 platform: process.platform,
                 homedir: os.homedir,
@@ -112,8 +143,14 @@ async function collectProductionReport(repoRoot, env) {
         },
         // The deny-enforcement probe is never spawned from this command; the check
         // is reported as an explicit skip naming `epic-implementer doctor` instead.
-        conductorDoctorDeps: { env, skipDenyProbe: true },
-        runPlanePreflight: () => runDefaultPlanePreflight(repoRoot, env),
+        conductorDoctorDeps: { env: reportEnv, skipDenyProbe: true },
+        // Provided ONLY for a target that names the local plane; otherwise the rows
+        // are skipped without any probe.
+        ...(planeNotApplicable === null
+            ? {
+                runPlanePreflight: () => runDefaultPlanePreflight(repoRoot, reportEnv),
+            }
+            : { planeNotApplicable }),
     });
 }
 /**
@@ -138,7 +175,7 @@ export async function runConductorReadinessCommand(argv, deps = {}) {
     }
     const cwd = deps.cwd ?? process.cwd();
     const env = deps.env ?? process.env;
-    const collect = deps.collect ?? ((repoRoot) => collectProductionReport(repoRoot, env));
+    const collect = deps.collect ?? ((repoRoot) => collectProductionReport(repoRoot, env, parsed.baseUrl));
     const report = await collect(cwd);
     // Fixed, sanitized, and stderr-only: never a credential, exception, header,
     // body, subprocess output, or absolute path. It fires on a COLLECTION gap,