@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/conductor/guided-repair.js

@@ -32,6 +32,9 @@ export const GUIDED_REPAIR_VERBS = [
     "scope-reparse",
     "scope-catch-up",
     "dispatch-remediation",
+    // BAPI-1388 — ticket-addressed, pinned to the same version-and-head subject as
+    // `dispatch-remediation`, and consuming the binding ExplainRun renders.
+    "rerun-ci",
 ];
 /** A malformed or mismatched binding. The message never echoes the token. */
 export class GuidedBindingError extends Error {
@@ -57,6 +60,7 @@ const ALLOWED_KEYS = {
     "scope-reparse": ["scope_id", "lifecycle_state", "required_commit_sha"],
     "scope-catch-up": ["scope_id", "lifecycle_state", "required_commit_sha"],
     "dispatch-remediation": ["ticket_key", "expected_row_version", "expected_head_sha"],
+    "rerun-ci": ["ticket_key", "expected_row_version", "expected_head_sha"],
 };
 function invalid() {
     return new GuidedBindingError("--binding is not a valid guided-repair binding; nothing was sent. Copy the " +
@@ -148,7 +152,7 @@ export function decodeGuidedBinding(token) {
             throw invalid();
         }
     }
-    else if (guidedVerb === "dispatch-remediation") {
+    else if (guidedVerb === "dispatch-remediation" || guidedVerb === "rerun-ci") {
         binding.ticketKey = boundedString(raw.ticket_key, 64);
         binding.expectedRowVersion = nonNegativeInt(raw.expected_row_version);
         binding.expectedHeadSha = optionalSha(raw.expected_head_sha);
@@ -202,7 +206,7 @@ export function guardForBinding(binding, requestId) {
             guard.block_reason = binding.blockReason;
         return guard;
     }
-    if (binding.verb === "dispatch-remediation") {
+    if (binding.verb === "dispatch-remediation" || binding.verb === "rerun-ci") {
         return {
             request_id: requestId,
             epic_run_id: binding.epicRunId,

package/build/conductor/hook-runtime-qualification.js

@@ -89,7 +89,7 @@ export const HOOK_RUNTIME_ACTIONS = {
         "from a persistent install.",
     "unqualified-runtime": "the hook runtime is not a qualified persistent installation (supported: a persistent npm " +
         `install of ${MCP_PACKAGE_NAME} ${HOOK_RUNTIME_COMPATIBLE_RANGE} on macOS or Linux with an even ` +
-        `Node LTS line >= ${HOOK_RUNTIME_MIN_NODE_MAJOR}). See mcp_server/docs/CONDUCTOR.md.`,
+        `Node LTS line >= ${HOOK_RUNTIME_MIN_NODE_MAJOR}). See mcp_server/docs/EPIC-IMPLEMENTER.md.`,
     "node-unavailable": "`node` could not be launched from PATH, so the hook cannot run. Put a qualified Node on PATH " +
         "and re-run `epic-implementer doctor`.",
     "native-unavailable": "better-sqlite3 does not load for the hook's Node, so no event can be recorded. Reinstall the " +

package/build/conductor/install-doctor.js

@@ -36,7 +36,7 @@ import { buildConductorDoctorReport, formatConductorDoctorReport, } from "./doct
 import { inspectBridgeApiProfileToken, } from "../mcp-host-config.js";
 import { collectExecutorServiceDiagnostics, formatExecutorServiceDiagnosticsReport, } from "../doctor.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, } from "../install-doctor.js";
-import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, gitHubActionsMergeObservabilitySections, conductorProfileTokenSection, EPIC_IMPLEMENTER_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, mergeExecutionSections, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
+import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, gitHubActionsMergeObservabilitySections, conductorProfileTokenSection, effectiveReviewModeIsRepositoryPolicy, epicBranchCiSections, EPIC_IMPLEMENTER_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, mergeExecutionSections, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
 import { ConductorBridgeApiError, fetchConductorReadiness, } from "./bridge-api-client.js";
 /**
  * Run one optional collector, containing any throw.
@@ -155,6 +155,11 @@ export async function runConductorInstallDoctor(deps) {
     }
     if (readiness) {
         sections.push(...supervisorSection(readiness));
+        // BAPI-1405 — the three warn-only epic-branch CI rows, beside the gate
+        // profile they qualify. Never fatal, so they cannot change the exit code or
+        // the installer's pre-write abort. An older server renders them as
+        // "Unreported — upgrade the server", never as "no warning".
+        sections.push(...epicBranchCiSections(readiness.epic_branch_ci));
         sections.push(githubCredentialsSection(readiness));
         sections.push(githubActionsSection(readiness));
         // BAPI-1135 — the shared "Merge execution eligibility" section, immediately
@@ -166,7 +171,12 @@ export async function runConductorInstallDoctor(deps) {
         sections.push(...mergeExecutionSections(readiness));
     }
     const workflow = await inspectWorkflowPresence(deps.readWorkflowFile, deps.classifyWorkflowDrift);
-    sections.push(workflowSection(workflow.presence, deps.reviewPolicySource, workflow.driftDetail));
+    // BAPI-1405 — when the server says the effective review mode is
+    // `repository_policy`, no review verdict is consumed, so the workflow row
+    // reports not-applicable instead of nagging. An older server keeps the
+    // caller's source exactly as before.
+    const effectiveReviewPolicySource = effectiveReviewModeIsRepositoryPolicy(readiness) ? "repository_policy" : deps.reviewPolicySource;
+    sections.push(workflowSection(workflow.presence, effectiveReviewPolicySource, workflow.driftDetail));
     if (readiness) {
         // BAPI-1153 — the "Bring-up safety" group, ahead of the repository-scoped
         // reconciler/executor story: these three decide whether a plane can drive a
@@ -357,6 +367,8 @@ mergeExecutionSections, databaseMigrationCurrentSection, singleTransitionAuthori
 // BAPI-1135 — both new section builders join the compatibility surface like
 // every other one, so an existing importer of this module does not learn a
 // second import path for them.
-gitHubActionsMergeObservabilitySections, } from "./readiness-sections.js";
+gitHubActionsMergeObservabilitySections, 
+// BAPI-1405 — the epic-branch CI rows and their shared copy.
+epicBranchCiSections, EPIC_BRANCH_CI_RERUN_INSTALL_ADVICE, EPIC_BRANCH_CI_SECTION_IDS, EPIC_BRANCH_CI_SECTION_LABELS, EPIC_BRANCH_CI_UNREPORTED_DETAIL, } from "./readiness-sections.js";
 // BAPI-1153 — the bring-up remediations the three sections above render.
 export { BRING_UP_RUNBOOK, BRING_UP_UNREPORTED_REMEDIATION, DATABASE_MIGRATION_BEHIND_REMEDIATION, DATABASE_MIGRATION_UNREADABLE_REMEDIATION, SECOND_RECONCILER_REMEDIATION, WORKER_HEARTBEAT_UNREADABLE_REMEDIATION, WORKER_NOT_PRESENT_REMEDIATION, } from "./bring-up-facts.js";

package/build/conductor/json-output.js

@@ -0,0 +1,63 @@
+/**
+ * Complete `--json` output for CLI commands (BAPI-1397, F3).
+ *
+ * The CLI ends through `process.exit(cliExitCode)` in `index.ts` as soon as a
+ * command returns its exit code. On macOS a piped stdout is asynchronous, so a
+ * large document written with `console.log` could still be queued when the
+ * process exited — a 72 KB `epic-status --json` reached its reader truncated.
+ *
+ * {@link writeJsonDocument} prints the already-serialized document through the
+ * same sink as before (so its bytes and the tests that capture `console.log` are
+ * unchanged) and then waits until stdout has handed every queued byte to the
+ * operating system before the command returns. It never changes a payload.
+ */
+/**
+ * Wait until `stream` has flushed everything written to it so far.
+ *
+ * A writable stream completes writes in order, so the callback of a zero-length
+ * write runs only after every earlier write has completed. Resolves `true` once
+ * flushed and `false` when the stream reports an error (for example a reader
+ * that closed the pipe). Never throws and never leaves an `error` listener
+ * behind, so a closed pipe cannot become an uncaught exception.
+ */
+export function flushOutputStream(stream) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            stream.removeListener("error", onError);
+            resolve(ok);
+        };
+        const onError = () => finish(false);
+        stream.once("error", onError);
+        try {
+            stream.write("", (error) => finish(!error));
+        }
+        catch {
+            finish(false);
+        }
+    });
+}
+/** Flush the real process stdout. */
+export function flushProcessStdout() {
+    return flushOutputStream(process.stdout);
+}
+/**
+ * Print one already-serialized JSON document and wait for stdout to drain.
+ *
+ * Resolves `true` when the whole document was handed to the operating system,
+ * `false` when the output could not complete. The text is printed exactly as
+ * given, so no command's JSON shape changes.
+ */
+export async function writeJsonDocument(serialized, deps = {}) {
+    const log = deps.log ?? ((line) => console.log(line));
+    try {
+        log(serialized);
+    }
+    catch {
+        return false;
+    }
+    return (deps.flush ?? flushProcessStdout)();
+}

package/build/conductor/merge-execution-contract.js

@@ -23,14 +23,13 @@
  * inspected a local checkout to decide merge eligibility would be answering a
  * different question from the one the server's before-merge preflight answers.
  *
- * ## Deferred remedy
+ * ## Remedy command
  *
- * {@link MERGE_WORKFLOW_REMEDY_COMMAND} names the generate-and-PR command epic
- * child 4 ships. Until child 4 lands, a refusal may name a command that is not
- * yet an executable entry point on the operator's machine. That residual risk,
- * its three containments, and who owns escalation are recorded once, in the
+ * {@link MERGE_WORKFLOW_REMEDY_COMMAND} is the complete generate-and-PR command that
+ * BAPI-1136 shipped (BAPI-1376 made it a full launcher command). Its history and containments are recorded once, in the
  * Python module's docstring; this mirror does not restate them.
  */
+import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 /** The one `RunPolicy.merge_execution_mode` value this contract governs. */
 export const MERGE_EXECUTION_MODE_GITHUB_ACTIONS = "github_actions";
 /**
@@ -80,7 +79,27 @@ export function mergeWorkflowVersionSupportsIntegrationActions(version) {
         INTEGRATION_ACTION_WORKFLOW_VERSIONS.includes(version));
 }
 /**
- * The single command that generates the merge workflow and opens its pull
- * request. Every refusal, remediation, and readiness line imports this constant.
+ * The dispatched subcommand that generates the merge workflow and opens its pull
+ * request. This is the part the CLI's own dispatcher (`index.ts`) matches on
+ * (`install`), not the launcher that starts it. The Python mirror derives its
+ * command head from this value.
  */
-export const MERGE_WORKFLOW_REMEDY_COMMAND = "install-bridge conductor --merge-workflow";
+export const MERGE_WORKFLOW_SUBCOMMAND = "install conductor --merge-workflow";
+/**
+ * The complete, copy-ready command that generates the merge workflow and opens
+ * its pull request. Every refusal, remediation, and readiness line imports this
+ * constant.
+ *
+ * The package name comes from `mcp-identity.ts`, the sole source of that
+ * literal (BAPI-806). That module is itself dependency-free, so this import can
+ * never close a cycle. The `<@org/team|@user>` placeholder is deliberately NOT a valid owner — the
+ * installer refuses it — so an operator must replace it before running.
+ */
+export const MERGE_WORKFLOW_REMEDY_COMMAND = `npx -y ${MCP_PACKAGE_NAME} ${MERGE_WORKFLOW_SUBCOMMAND} --codeowner <@org/team|@user>`;
+/**
+ * One reusable instruction to print beside {@link MERGE_WORKFLOW_REMEDY_COMMAND}.
+ * Bridge cannot infer who should review the workflow file, so the placeholder
+ * must be replaced by hand.
+ */
+export const MERGE_WORKFLOW_CODEOWNER_INSTRUCTION = "Bridge cannot infer the code owner. Before running, replace <@org/team|@user> " +
+    "with the one @user or @org/team who should review the workflow file.";

package/build/conductor/merge-execution-eligibility.js

@@ -31,7 +31,7 @@
  * not eligible: it is a workflow this build has never been taught to reason
  * about, and "newer is probably fine" is a guess about a merge actuator.
  */
-import { MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS, MERGE_WORKFLOW_REMEDY_COMMAND, mergeWorkflowVersionSupportsChildMerge, } from "./merge-execution-contract.js";
+import { MERGE_WORKFLOW_CHILD_MERGE_COMPATIBLE_VERSIONS, MERGE_WORKFLOW_CODEOWNER_INSTRUCTION, MERGE_WORKFLOW_REMEDY_COMMAND, mergeWorkflowVersionSupportsChildMerge, } from "./merge-execution-contract.js";
 /**
  * Remediation for a verdict that could not be established.
  *
@@ -51,7 +51,8 @@ export const MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION = "re-run once the Bridge
  * second way.
  */
 export const MERGE_EXECUTION_INELIGIBLE_REMEDIATION = `run \`${MERGE_WORKFLOW_REMEDY_COMMAND}\` to generate the merge workflow and open its ` +
-    "pull request, then re-run once it is merged to the default branch.";
+    `pull request. ${MERGE_WORKFLOW_CODEOWNER_INSTRUCTION} ` +
+    "Then re-run once it is merged to the default branch.";
 function unverifiable(reason, detail) {
     return {
         status: "could_not_verify",

package/build/conductor/pr-ci-producer.js

@@ -531,7 +531,7 @@ export async function observePrCiFromPollResponse(commitRef, pollResponse, deps
 function extractTicketKeyFromRef(headRef) {
     if (!headRef)
         return null;
-    const match = /([A-Z][A-Z0-9]+-\d+)/i.exec(headRef);
+    const match = /([A-Z][A-Z0-9_]{0,19}-\d+)/i.exec(headRef);
     return match ? match[1].toUpperCase() : null;
 }
 /**

package/build/conductor/readiness-cli.js

@@ -35,22 +35,31 @@
 import os from "node:os";
 import { readFile as fsReadFile, stat as fsStat } from "node:fs/promises";
 import { collectConductorReadinessGate, formatConductorReadinessGateReport, } from "./readiness.js";
-import { readinessEndpointEnvironments, resolveConductorBridgeApiAccess, resolveEpicLaunchBridgeApiAccess } from "./bridge-api-client.js";
+import { fetchEffectiveSupervisorSetup, readinessEndpointEnvironments, resolveConductorBridgeApiAccess, resolveEpicLaunchBridgeApiAccess, } from "./bridge-api-client.js";
+import { createCommandDriftInspector } from "./command-drift-production.js";
+import { flushProcessStdout, writeJsonDocument } from "./json-output.js";
 import { validateHttpBaseUrl } from "../base-url.js";
 import { claudeReviewWorkflowPath } from "../claude-review-workflow.js";
 import { runDefaultPlanePreflight } from "../plane/cli.js";
+import { planeNotApplicableForTarget } from "../plane/endpoint.js";
+import { resolvePlaneServerEndpoint } from "../plane/member-roster.js";
 /** Fixed notice emitted to stderr when a source could not be collected. */
 export const READINESS_COLLECTION_NOTICE = "one or more readiness sources could not be collected; the affected prerequisites are reported as failures.";
 /** Usage text for `epic-implementer readiness`. */
 export function getReadinessUsage() {
     return [
-        "Usage: epic-implementer readiness [--json] [--no-deny-probe] [--base-url <url>]",
+        "Usage: epic-implementer readiness [--json] [--no-deny-probe] [--base-url <url>] [--epic-run-id <id>]",
         "",
         "Read-only ADVISORY report of every conductor prerequisite, consolidated from the",
         "Bridge install checklist, the epic-implementer doctor, the plane preflight, and the",
         "server conductor-readiness collector. Each prerequisite reports pass/warn/fail/skip",
         "and, on a failure, exactly ONE named remediation.",
         "",
+        "The claude-review workflow row is assessed for a NEW feature-branch run's first",
+        "approval: it is not applicable only when the server confirms no repository review",
+        "default is set. If that cannot be confirmed the row stays required. This report is",
+        "not a prediction or an authorization of any particular run.",
+        "",
         "Remediations are NOT run automatically. This command changes nothing: it starts no",
         "plane, approves no run, writes no file, and always exits 0 — `drive-epic` remains",
         "the only route-selection gate and the server-side admission the only hard refusal.",
@@ -61,6 +70,9 @@ export function getReadinessUsage() {
         "                    this command never spawns the deny-enforcement probe",
         "  --base-url <url>  Select a read-only Bridge API endpoint for this report;",
         "                    this does not authorize or supply a credential",
+        "  --epic-run-id <id>",
+        "                    The epic run being attached. When the live plane is bound to",
+        "                    this run, its port and manifest rows pass with reason own_plane",
         "  --help            Print this usage message",
     ].join("\n");
 }
@@ -84,11 +96,64 @@ export function parseReadinessArgs(argv) {
                 return { error: "--base-url requires a valid HTTP(S) URL." };
             parsed.baseUrl = valid.baseUrl;
         }
+        else if (token === "--epic-run-id") {
+            const raw = argv[++index];
+            if (!raw || raw.startsWith("--") || raw.trim() === "") {
+                return { error: "--epic-run-id requires an epic run id." };
+            }
+            parsed.epicRunId = raw.trim();
+        }
         else
             return { error: `Unknown argument "${token}". Run "epic-implementer readiness --help" for usage.` };
     }
     return parsed;
 }
+const KNOWN_REVIEW_POLICY_SOURCES = [
+    "verdict_protocol",
+    "native_review_decision",
+    "none",
+    "repository_policy",
+];
+/**
+ * Choose the review-policy source the workflow row is judged under (BAPI-1406).
+ *
+ * `repository_policy` is selected ONLY when a successful, parseable response
+ * explicitly confirms the repository's effective review default is unset: the
+ * `review_policy` key is present and `null`. A stored default is respected, and
+ * an unknown or missing source falls back to `verdict_protocol`. Every other
+ * outcome — no access, a read failure, a malformed body, a missing key (an older
+ * server), an unrecognised value — returns `verdict_protocol`, so the workflow
+ * row stays required rather than falsely healthy.
+ *
+ * Read-only: one GET through the existing supervisor-setup client. This answers
+ * "what would a new feature-branch run's first approval resolve to", which is a
+ * prospective assessment and not a prediction or authorization of any run.
+ */
+export async function resolveReadinessReviewPolicySource(access, fetchImpl) {
+    if (access === null)
+        return "verdict_protocol";
+    try {
+        const setup = await fetchEffectiveSupervisorSetup(access, undefined, fetchImpl);
+        if (typeof setup !== "object" || setup === null || Array.isArray(setup)) {
+            return "verdict_protocol";
+        }
+        const record = setup;
+        if (!Object.prototype.hasOwnProperty.call(record, "review_policy")) {
+            return "verdict_protocol";
+        }
+        const reviewPolicy = record.review_policy;
+        if (reviewPolicy === null)
+            return "repository_policy";
+        if (typeof reviewPolicy !== "object" || Array.isArray(reviewPolicy)) {
+            return "verdict_protocol";
+        }
+        const source = reviewPolicy.source;
+        return KNOWN_REVIEW_POLICY_SOURCES.find((known) => known === source) ?? "verdict_protocol";
+    }
+    catch {
+        return "verdict_protocol";
+    }
+}
 /**
  * Build the production report for `repoRoot`.
  *
@@ -96,17 +161,26 @@ export function parseReadinessArgs(argv) {
  * epic-implementer doctor's local inspections, and the same plane preflight
  * `plane up` and `drive-epic` run. Nothing is re-implemented here.
  */
-async function collectProductionReport(repoRoot, env, baseUrl) {
+async function collectProductionReport(repoRoot, env, baseUrl, epicRunId) {
     const { reportEnv, resolverEnv } = readinessEndpointEnvironments(env, baseUrl);
     const accessResult = baseUrl === undefined
         ? await resolveConductorBridgeApiAccess({ env: reportEnv, cwd: repoRoot })
         : await resolveEpicLaunchBridgeApiAccess({ baseUrl }, { env: resolverEnv, cwd: repoRoot });
+    // BAPI-1360: the plane checks apply only when the selected access target names
+    // the local plane. Resolved from the SAME env the plane preflight reads, through
+    // the shared leaf predicate `drive-epic` uses, and never guessed: a target that
+    // is remote, or that cannot be resolved at all, is an explicit skip.
+    const planeNotApplicable = planeNotApplicableForTarget(resolvePlaneServerEndpoint(reportEnv), accessResult.ok ? accessResult.access.baseUrl : null);
     if (baseUrl !== undefined && !accessResult.ok) {
         // A refused override is never permission for a downstream doctor collector
         // to resolve credentials afresh from the general CLI environment.
-        return collectConductorReadinessGate({ repoName: null });
+        return collectConductorReadinessGate({
+            repoName: null,
+            ...(planeNotApplicable !== null ? { planeNotApplicable } : {}),
+        });
     }
     const access = accessResult.ok ? accessResult.access : null;
+    const reviewPolicySource = await resolveReadinessReviewPolicySource(access);
     return collectConductorReadinessGate({
         // Never guessed: an unresolved identity is reported as such rather than
         // invented, and the repository ROOT is never placed in the report at all.
@@ -115,10 +189,11 @@ async function collectProductionReport(repoRoot, env, baseUrl) {
             access,
             accessError: accessResult.ok ? undefined : accessResult.error,
             fetch: (...args) => fetch(...args),
-            // The consolidated gate reports workflow presence as a fact; it selects no
-            // per-run review policy, so applicability is evaluated under the policy
-            // that always consumes the workflow's verdict.
-            reviewPolicySource: "verdict_protocol",
+            // BAPI-1406: the workflow row is judged under the review default the
+            // server CONFIRMS for a new feature-branch run's first approval, and under
+            // `verdict_protocol` whenever that cannot be established. This is a
+            // prospective assessment, not a prediction or authorization of any run.
+            reviewPolicySource,
             readWorkflowFile: () => fsReadFile(claudeReviewWorkflowPath(repoRoot), "utf-8"),
             projectRoot: repoRoot,
             installDoctorDeps: {
@@ -133,8 +208,21 @@ async function collectProductionReport(repoRoot, env, baseUrl) {
         },
         // The deny-enforcement probe is never spawned from this command; the check
         // is reported as an explicit skip naming `epic-implementer doctor` instead.
-        conductorDoctorDeps: { env: reportEnv, skipDenyProbe: true },
-        runPlanePreflight: () => runDefaultPlanePreflight(repoRoot, reportEnv),
+        conductorDoctorDeps: {
+            env: reportEnv,
+            skipDenyProbe: true,
+            // BAPI-1392: read-only, warn-only committed-command drift row.
+            inspectCommandDrift: createCommandDriftInspector({ env: reportEnv, cwd: repoRoot }),
+        },
+        // Provided ONLY for a target that names the local plane; otherwise the rows
+        // are skipped without any probe.
+        ...(planeNotApplicable === null
+            ? {
+                runPlanePreflight: () => runDefaultPlanePreflight(repoRoot, reportEnv),
+                // BAPI-1397 (F4): only for an applicable local plane.
+                ...(epicRunId !== undefined ? { epicRunId } : {}),
+            }
+            : { planeNotApplicable }),
     });
 }
 /**
@@ -159,7 +247,8 @@ export async function runConductorReadinessCommand(argv, deps = {}) {
     }
     const cwd = deps.cwd ?? process.cwd();
     const env = deps.env ?? process.env;
-    const collect = deps.collect ?? ((repoRoot) => collectProductionReport(repoRoot, env, parsed.baseUrl));
+    const collect = deps.collect ??
+        ((repoRoot) => collectProductionReport(repoRoot, env, parsed.baseUrl, parsed.epicRunId));
     const report = await collect(cwd);
     // Fixed, sanitized, and stderr-only: never a credential, exception, header,
     // body, subprocess output, or absolute path. It fires on a COLLECTION gap,
@@ -167,7 +256,19 @@ export async function runConductorReadinessCommand(argv, deps = {}) {
     // every time an ordinary check fails teaches operators to ignore it.
     if (report.unavailableSources.length > 0)
         sinks.stderr(READINESS_COLLECTION_NOTICE);
-    sinks.stdout(parsed.json ? JSON.stringify(report) : formatConductorReadinessGateReport(report));
+    if (parsed.json) {
+        // BAPI-1397 (F3): the document goes through the shared CLI writer, which waits
+        // for a piped stdout to drain. An injected sink is the caller's own boundary,
+        // so only the production stdout is flushed. Output completion never becomes a
+        // readiness verdict and never changes the advisory exit code.
+        await writeJsonDocument(JSON.stringify(report), {
+            log: sinks.stdout,
+            flush: deps.sinks ? async () => true : flushProcessStdout,
+        });
+    }
+    else {
+        sinks.stdout(formatConductorReadinessGateReport(report));
+    }
     // Advisory: the exit code is a constant, never derived from a check status.
     return 0;
 }