@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/conductor/readiness.js

@@ -92,15 +92,17 @@
  * unrelated additive change look like a breaking one here, or worse, hide a real
  * one.
  */
+import { PRINTED_CHECK_NAME_INSTRUCTION, PRINTED_CONDUCTOR_EXECUTOR_INSTALL_COMMAND, PRINTED_CONDUCTOR_INSTALL_COMMAND, PRINTED_CONNECT_GITHUB_COMMAND, PRINTED_EXECUTOR_ID_INSTRUCTION, PRINTED_QUALIFY_GATE_COMMAND, } from "../printed-remedy-commands.js";
 import { mapConductorDoctorReportToReadinessChecks, } from "./doctor.js";
 import { mapInstallStatusChecksToReadinessChecks, } from "../install-doctor.js";
 import { mapPlanePreflightToReadinessChecks, } from "../plane/preflight.js";
 import { runConductorInstallDoctor, } from "./install-doctor.js";
-import { BRING_UP_SECTION_LABELS, presentRequiredChecks, } from "./readiness-sections.js";
+import { BRING_UP_SECTION_LABELS, describeGateProfile, describeGateProfileWarning, effectiveReviewModeIsRepositoryPolicy, EPIC_BRANCH_CI_SECTION_IDS, epicBranchCiSections, presentRequiredChecks, quotedSubject, } from "./readiness-sections.js";
 import { classifyBringUpFacts } from "./bring-up-facts.js";
+import { CI_WORKFLOW_PATH, REVIEW_WORKFLOW_PATH, ciWorkflowRemedy, repositoryWorkflowRemedy, } from "./repository-workflow-remedy.js";
 import { classifyMergeExecutionEligibility, MERGE_EXECUTION_INELIGIBLE_REMEDIATION, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
 import { createReadinessCheck, createReadinessCheckSafely, summarizeReadinessChecks, validateReadinessChecks, } from "../readiness-check.js";
-import { ADMISSION_EVIDENCE_SCHEMA_VERSION, } from "./bridge-api-client.js";
+import { ADMISSION_EVIDENCE_SCHEMA_VERSION, gateProfileWaivesCiWorkflow, } from "./bridge-api-client.js";
 /** This report's own schema version. See the module docstring. */
 export const CONDUCTOR_READINESS_GATE_SCHEMA_VERSION = 1;
 /** Fixed statement carried in every report, so no consumer can mistake it for a gate. */
@@ -137,7 +139,10 @@ export const SERVER_READINESS_DESCRIPTORS = [
         id: "single-transition-authority",
         label: BRING_UP_SECTION_LABELS["single-transition-authority"],
     },
-    { id: "reconciler-liveness", label: "Reconciler tick liveness" },
+    // The stable ID stays `reconciler-liveness`; only the label changed (BAPI-1360),
+    // because the row reports whether ACTIVE runs are making progress, not whether a
+    // reconciler process exists.
+    { id: "reconciler-liveness", label: "Active-run progress" },
     { id: "executor-readiness", label: "Executor server observation" },
     { id: "review-workflow", label: "Review workflow protocol" },
     { id: "conductor-ci-workflow", label: "Conductor CI migration guard" },
@@ -145,7 +150,7 @@ export const SERVER_READINESS_DESCRIPTORS = [
     // third unattended refusal reads. Noun phrases, like every row above: these
     // render as list items under a source heading, not as sentences.
     { id: "unattended-consent", label: "Repository unattended consent" },
-    { id: "unattended-notify-default", label: "Verified notify webhook default" },
+    { id: "unattended-notify-default", label: "Escalation channel (webhook or email)" },
     { id: "repository-workflow-readiness", label: "Repository workflow readiness" },
 ];
 /** Fixed, secret-free prose per failure kind. Never a status body or header. */
@@ -169,23 +174,29 @@ const SERVER_FAILURE_COPY = {
 };
 /** Remediations for the individual server facts, as fixed prose. */
 const SERVER_REMEDIATIONS = {
-    supervisorSetup: "run `install conductor` (or `setup-epic`) for this repository to write the project-default supervisor posture.",
-    supervisorConfig: "run `install conductor` for this repository to write the project-default supervisor configuration.",
+    supervisorSetup: `run \`${PRINTED_CONDUCTOR_INSTALL_COMMAND}\` (or \`setup-epic\`) for this repository to write the project-default supervisor posture. ${PRINTED_CHECK_NAME_INSTRUCTION}`,
+    supervisorConfig: `run \`${PRINTED_CONDUCTOR_INSTALL_COMMAND}\` for this repository to write the project-default supervisor configuration. ${PRINTED_CHECK_NAME_INSTRUCTION}`,
     mergeApproval: "set the merge-approval requirement explicitly in the supervisor configuration rather than leaving it unset.",
     reviewPolicyMissing: "set the repository review-policy default so the merge path and the code_review gate read the same signal.",
     reviewPolicyDivergent: "align the repository review-policy default with the done gate's review_state condition, or confirm the difference is intended.",
-    githubCredentials: "connect GitHub from the Bridge setup UI (`install-bridge connect-github`) so owner, repository id, and installation id all resolve.",
+    githubCredentials: `connect GitHub from the Bridge setup UI or run \`${PRINTED_CONNECT_GITHUB_COMMAND}\` so owner, repository id, and installation id all resolve.`,
     actionsProbeFailed: "re-run once credentials resolve; the permission could not be checked, which is not the same as confirmed-missing.",
     actionsMissing: "grant the GitHub App `actions: write`; without it the conductor's workflow rerun lane fails open on 403.",
     reconcilerUnreadable: "retry once the Bridge API is reachable; reconciler liveness is unknown here, not confirmed stale.",
-    reconcilerStale: "start the reconciler for this repository (the `epic-implementer epic-tick` schedule) so ticks resume.",
+    // BAPI-1360: the frozen `epic-tick` command is never named. The reconciler runs
+    // inside the worker, so the first check is that the worker is up, then the run's
+    // own status.
+    reconcilerStale: "check the worker first (`server.worker-present`), then inspect the stalled run with `epic-implementer epic-status`.",
     executorUnreadable: "retry once the Bridge API is reachable; no executor readiness claim is ever made from local state.",
-    executorNeverSeen: "provision and start an executor (`install conductor --executor-id <id> --repo-wide` or `executor install-service`); readiness comes only from a live server observation.",
+    executorNeverSeen: `provision and start an executor (\`${PRINTED_CONDUCTOR_EXECUTOR_INSTALL_COMMAND}\` or \`executor install-service\`); readiness comes only from a live server observation. ${PRINTED_CHECK_NAME_INSTRUCTION} ${PRINTED_EXECUTOR_ID_INSTRUCTION}`,
+    executorNoneObservedNoRuns: `no action is needed to launch: \`drive-epic\` starts a run-scoped executor. To keep an executor running between runs, install one with \`${PRINTED_CONDUCTOR_EXECUTOR_INSTALL_COMMAND}\` or \`executor install-service\`. ${PRINTED_CHECK_NAME_INSTRUCTION} ${PRINTED_EXECUTOR_ID_INSTRUCTION}`,
     executorStale: "restart the executor service; it was observed once and has gone quiet past the server's staleness threshold.",
     reviewWorkflowUnknown: "re-run; the default branch's review workflow could not be evaluated, which is not the same as it being absent.",
     reviewWorkflowIncomplete: "install the claude-review workflow template on the default branch so it emits both the run id and the reviewed SHA the verdict protocol reads.",
     ciWorkflowUnknown: "re-run; the default branch's conductor CI workflow could not be evaluated, which is not the same as the guard being absent.",
-    ciWorkflowMissingGuard: "add the migration-guard job to the conductor CI workflow on the default branch so migrations are checked before a merge.",
+    // BAPI-1359: the missing-guard remedy is built by `ciWorkflowRemedy` (the shared
+    // formatter), because its wording depends on WHY the guard is missing — a
+    // confirmed Alembic chain, an older server, or an unreadable answer.
     olderServer: "upgrade the Bridge API deploy so it reports this fact; its state is unknown here, not healthy.",
     // BAPI-1102. Each names the ONE action that clears it, and none of them
     // mentions a webhook URL, a destination, or any configuration value.
@@ -193,7 +204,10 @@ const SERVER_REMEDIATIONS = {
     // admin panel's Setup page. No MCP or CLI surface ever writes it.
     unattendedConsent: "turn on 'Allow unattended Epic Implementer runs' on the repository's Setup page in the Bridge admin panel, or run setup with --attended. If it is already on, contact Bridge support.",
     unattendedNotifyDefault: "supply a --policy-file declaring notify.webhook_url, or add an email address to the account so escalation alerts can be emailed, or run setup with --attended; an unattended run must have a working escalation channel, and notify.local_sink is not one.",
-    repositoryWorkflowReadiness: "run `install-bridge conductor` so the review and conductor-CI workflows are confirmed on the default branch, or run setup with --attended.",
+    // BAPI-1359: the `repository-workflow-readiness` remedy is built by
+    // `repositoryWorkflowRemedy` (the shared formatter) from the SAME report, so it
+    // names the specific missing item. The generic "run `install-bridge
+    // conductor`" text was retired: no install step creates a migration-guard job.
     // BAPI-1135. Both are IMPORTED from the shared classifier rather than written
     // out here, so the remedy command has exactly one spelling across the refusal,
     // the readiness row, and the doctor — see `merge-execution-contract.ts`.
@@ -331,14 +345,31 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
             label,
             status: outcome.status,
             detail: outcome.detail,
+            // A pass carries no remediation, and a `skip` carries one only when its
+            // outcome supplied one: the older-server default would misdescribe a fact
+            // that was deliberately not evaluated.
             ...(outcome.status === "pass"
                 ? {}
-                : { remediation: outcome.remediation ?? SERVER_REMEDIATIONS.olderServer }),
+                : outcome.status === "skip"
+                    ? outcome.remediation === undefined
+                        ? {}
+                        : { remediation: outcome.remediation }
+                    : { remediation: outcome.remediation ?? SERVER_REMEDIATIONS.olderServer }),
         });
     });
     // BAPI-1260 — appended ONLY when the server reported the block, so every
     // pre-BAPI-1260 report keeps exactly the descriptor set above.
-    return [...described, ...admissionEvidenceChecks(readiness), ...genericDiagnosticChecks(readiness)];
+    return [
+        ...described,
+        ...admissionEvidenceChecks(readiness),
+        // BAPI-1390 — appended ONLY when the server reported a gate profile.
+        ...gateProfileChecks(readiness),
+        // BAPI-1405 — always three warn-only epic-branch CI rows. An older server
+        // that omits the block renders them as "Unreported — upgrade the server",
+        // never as "no warning".
+        ...epicBranchCiChecks(readiness),
+        ...genericDiagnosticChecks(readiness),
+    ];
 }
 function genericDiagnosticChecks(readiness) {
     return (readiness.diagnostics ?? []).map((diagnostic, index) => {
@@ -377,6 +408,190 @@ const ADMISSION_OWNER_REMEDIATION = {
     repository_admin: "a repository administrator resolves it (unattended consent is the 'Allow unattended Epic Implementer runs' toggle on the repository's Setup page in the Bridge admin panel); setup never grants it.",
     bridge_operations: "escalate to Bridge operations; this is not something an operator command can change.",
 };
+/** The retired and current Bridge CI gate names, spelled once for the fixed remedies. */
+const RETIRED_GATE_NAME = "conductor-ci / gate";
+const CURRENT_GATE_NAME = "epic-implementer-ci / gate";
+/**
+ * Fixed, per-reason remedies (BAPI-1360). Assembled from literals and the two
+ * hard-coded workflow paths only: a record's reason picks a template, and nothing
+ * from the payload is interpolated. `null` means "no specific remedy — use the
+ * owner's generic one".
+ */
+function admissionReasonRemedy(record, readiness) {
+    const sup = readiness.supervisor;
+    const ciAbsent = sup.required_checks_ci_workflow_absent === true ||
+        (readiness.conductor_ci_workflow?.probe_succeeded === true &&
+            readiness.conductor_ci_workflow?.workflow_present === false);
+    const reviewAbsent = sup.required_checks_review_workflow_absent === true ||
+        (readiness.review_workflow?.probe_succeeded === true &&
+            readiness.review_workflow?.workflow_present === false);
+    switch (record.reason) {
+        case "review_workflow_unconfirmed":
+            return (`a repository administrator adds ${REVIEW_WORKFLOW_PATH} to the default branch, or repairs it so it ` +
+                "emits the run-id: and Reviewed-SHA: markers in its verdict comment; setup never grants it.");
+        case "conductor_ci_workflow_unconfirmed":
+            return (`a repository administrator adds ${CI_WORKFLOW_PATH} to the default branch, or repairs it (a ` +
+                "migration-guard job is required when the repository has alembic.ini); setup never grants it.");
+        case "required_checks_lane_workflow_absent": {
+            const files = [ciAbsent ? CI_WORKFLOW_PATH : null, reviewAbsent ? REVIEW_WORKFLOW_PATH : null].filter((file) => file !== null);
+            const named = files.length > 0 ? files.join(" and ") : `${CI_WORKFLOW_PATH} and ${REVIEW_WORKFLOW_PATH}`;
+            return (`a repository administrator adds ${named} to the default branch so the configured required ` +
+                `checks (such as ${CURRENT_GATE_NAME}) have a producer; setup never grants it.`);
+        }
+        case "required_check_retired_gate":
+            return (`a repository administrator replaces ${RETIRED_GATE_NAME} with ${CURRENT_GATE_NAME} in the plan's ` +
+                "required_checks, in the supervisor done-gate checks, and in branch protection." +
+                (ciAbsent ? ` Also add ${CI_WORKFLOW_PATH} to the default branch so ${CURRENT_GATE_NAME} has a producer.` : ""));
+        default:
+            return gateProfileReasonRemedy(record.reason, record.verdict, record.subject ?? null);
+    }
+}
+/** The provider-evidence window the server searches, spelled once for the remedies. */
+const PROVIDER_EVIDENCE_WINDOW = "the last 12 default-branch commits or 8 merged pull-request heads from the last 90 days";
+/**
+ * BAPI-1390 — fixed remedies for the four gate-profile reasons. Everything is a
+ * literal except the validated `subject`. `null` for any other reason, so an
+ * unknown reason falls back to the owner's generic remedy.
+ */
+function gateProfileReasonRemedy(reason, verdict, subject) {
+    switch (reason) {
+        case "provider_check_unseen":
+            return (`a repository administrator confirms that the check ${quotedSubject(subject, "named in the gate profile")} ` +
+                `reports on the default branch — it was not seen on ${PROVIDER_EVIDENCE_WINDOW} — or edits the gate ` +
+                "profile; setup never grants it.");
+        case "provider_evidence_unavailable":
+            return (`Bridge could not read the provider's check history for ${quotedSubject(subject, "a gate-profile check")} ` +
+                `(${PROVIDER_EVIDENCE_WINDOW}), so it is unknown, not absent. Re-run readiness; if it persists, ` +
+                "escalate to Bridge operations.");
+        case "local_command_unqualified":
+            return verdict === "unable_to_verify"
+                ? `the qualification of the local gate command ${quotedSubject(subject, "in the gate profile")} could not ` +
+                    "be read, so it is unknown, not qualified. Re-run readiness; if it persists, escalate to Bridge operations."
+                : `the local gate command ${quotedSubject(subject, "in the gate profile")} is not qualified for the current ` +
+                    "gate-profile revision (unqualified or stale). Qualify it with " +
+                    `\`${PRINTED_QUALIFY_GATE_COMMAND}\`, or have a repository administrator ` +
+                    "edit the gate profile.";
+        case "migration_guard_unset":
+            return verdict === "unable_to_verify"
+                ? "Bridge could not confirm whether this repository has alembic.ini on its default branch, so it could " +
+                    "not decide whether the gate profile needs a migration guard. Re-run readiness, or have a repository " +
+                    "administrator set a migration guard in the gate profile."
+                : "this repository has alembic.ini on its default branch, so its gate profile must name a migration " +
+                    "guard (a provider check or a local command). A repository administrator sets it in the gate " +
+                    "profile; setup never grants it.";
+        default:
+            return null;
+    }
+}
+const GATE_PROFILE_WARNING_REMEDIATION = "no action is needed to launch; confirm the check reports once an epic branch runs CI.";
+/**
+ * BAPI-1390 — the gate-profile row plus one warn row per warning. Appended
+ * ONLY when the server reported the block, so an older server's report is
+ * unchanged. The row is descriptive: the server's admission evidence is the
+ * authority, and the warning rows never hold a launch.
+ */
+export function gateProfileChecks(readiness) {
+    const profile = readiness.gate_profile;
+    if (profile === undefined)
+        return [];
+    if (profile === null) {
+        return [
+            createReadinessCheckSafely({
+                id: "server.gate-profile",
+                source: "server",
+                label: "Gate profile",
+                status: "fail",
+                detail: "the server reported no gate profile, so the CI gate is unverified",
+                remediation: SERVER_REMEDIATIONS.olderServer,
+            }),
+        ];
+    }
+    const detail = describeGateProfile(profile);
+    let row;
+    if (profile.read_failed || profile.stored_malformed) {
+        row = createReadinessCheckSafely({
+            id: "server.gate-profile",
+            source: "server",
+            label: "Gate profile",
+            status: "fail",
+            detail: `${profile.read_failed ? "the stored gate profile could not be read" : "the stored gate profile is malformed"} — ${detail}`,
+            remediation: profile.read_failed
+                ? "re-run readiness; if it persists, escalate to Bridge operations."
+                : "a repository administrator re-saves the gate profile; setup never grants it.",
+        });
+    }
+    else if (profile.verdict === "denied" || profile.verdict === "unable_to_verify") {
+        row = createReadinessCheckSafely({
+            id: "server.gate-profile",
+            source: "server",
+            label: "Gate profile",
+            status: "fail",
+            detail: `${profile.verdict === "denied" ? "DENIED" : "could not be verified"}${profile.reason ? ` (${profile.reason})` : ""} — ${detail}`,
+            remediation: gateProfileReasonRemedy(profile.reason, profile.verdict, profile.subject) ??
+                (profile.verdict === "denied"
+                    ? ADMISSION_OWNER_REMEDIATION.repository_admin
+                    : ADMISSION_OWNER_REMEDIATION.bridge_operations),
+        });
+    }
+    else if (profile.verdict === "confirmed" && profile.kind !== "none") {
+        row = createReadinessCheckSafely({
+            id: "server.gate-profile",
+            source: "server",
+            label: "Gate profile",
+            status: "pass",
+            detail,
+        });
+    }
+    else {
+        row = createReadinessCheckSafely({
+            id: "server.gate-profile",
+            source: "server",
+            label: "Gate profile",
+            status: "warn",
+            detail,
+            remediation: profile.kind === "none"
+                ? "no action is needed to launch; to let child merges proceed without approval, a repository administrator adds checks to the gate profile."
+                : "a repository administrator confirms the gate profile; the server's launch evidence decides whether a run is held.",
+        });
+    }
+    const warnings = profile.warnings.map((warning, index) => createReadinessCheckSafely({
+        id: `server.gate-profile-warning-${index + 1}`,
+        source: "server",
+        label: "Gate profile warning",
+        status: "warn",
+        detail: describeGateProfileWarning(warning.code, warning.name),
+        remediation: GATE_PROFILE_WARNING_REMEDIATION,
+    }));
+    return [row, ...warnings];
+}
+/**
+ * BAPI-1405 — the three warn-only epic-branch CI rows as `server.*` checks:
+ * `server.effective-review-mode`, `server.epic-branch-ci-decision`, and
+ * `server.epic-branch-ci-coverage-warning`.
+ *
+ * Built from the SAME shared sections the install doctor renders, so the two
+ * surfaces cannot word one fact apart. Status is only ever `pass` or `warn`:
+ * these rows never fail, never hold a launch, and feed no verdict.
+ *
+ * Unlike `gateProfileChecks`, an absent or `null` block (older server) still
+ * yields the three rows, each `warn` with "Unreported — upgrade the server" and
+ * the upgrade remediation. Emitting nothing would read as "no warning", which
+ * is the wrong answer: the server simply did not say. Omitted and `null` render
+ * identically. The install doctor's own copies of these sections are filtered
+ * by `INSTALL_SECTION_IDS_OWNED_ELSEWHERE`, so each row still appears once.
+ */
+export function epicBranchCiChecks(readiness) {
+    return epicBranchCiSections(readiness.epic_branch_ci).map((section) => createReadinessCheckSafely({
+        id: `server.${section.id}`,
+        source: "server",
+        label: section.label,
+        status: section.status === "ok" ? "pass" : "warn",
+        detail: section.detail,
+        ...(section.status === "ok" || section.remediation === undefined
+            ? {}
+            : { remediation: section.remediation }),
+    }));
+}
 /**
  * Project the server's typed launch evidence (BAPI-1260) into `server.*`
  * checks, read-only.
@@ -405,13 +620,30 @@ export function admissionEvidenceChecks(readiness) {
             }),
         ];
     }
-    return evidence.records.map((record) => admissionEvidenceCheck(record));
+    return evidence.records.map((record) => admissionEvidenceCheck(record, readiness));
 }
-function admissionEvidenceCheck(record) {
+function admissionEvidenceCheck(record, readiness) {
     const slug = record.predicate.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
     const label = ADMISSION_EVIDENCE_LABELS[record.predicate] ?? "Launch evidence";
     const reason = record.reason ? ` (${record.reason})` : "";
-    const remediation = ADMISSION_OWNER_REMEDIATION[record.next_action_owner ?? "operator"] ?? ADMISSION_OWNER_REMEDIATION.operator;
+    const remediation = admissionReasonRemedy(record, readiness) ??
+        ADMISSION_OWNER_REMEDIATION[record.next_action_owner ?? "operator"] ??
+        ADMISSION_OWNER_REMEDIATION.operator;
+    // BAPI-1360: the durable-actor handshake being unsupported is a known, current
+    // limitation, not a hold — it renders as a warning that says so. Every other
+    // predicate, and every other reason for this one, keeps its existing branch.
+    if (record.predicate === "durable_actor" && record.reason === "actor_handshake_unsupported") {
+        return createReadinessCheckSafely({
+            id: `server.admission-${slug}`,
+            source: "server",
+            label,
+            status: "warn",
+            detail: `not yet supported by this deploy${reason} — this does not hold a launch`,
+            // Fixed, non-escalating: the owner remedy would tell the operator to escalate
+            // for a limitation that blocks nothing.
+            remediation: "no action is needed to launch; this warning clears once the deploy supports the durable-actor handshake.",
+        });
+    }
     switch (record.verdict) {
         case "confirmed":
             return createReadinessCheckSafely({
@@ -503,7 +735,7 @@ function unattendedOutcomes(readiness) {
             ? {
                 id: "unattended-consent",
                 status: "pass",
-                detail: "this repository has consented to unattended conductor runs",
+                detail: "this repository has consented to unattended Epic Implementer runs",
             }
             : {
                 id: "unattended-consent",
@@ -540,13 +772,22 @@ function unattendedOutcomes(readiness) {
             ? {
                 id: "repository-workflow-readiness",
                 status: "pass",
-                detail: "the review and conductor-CI workflows are both confirmed",
+                detail: "the review and epic-implementer-ci workflows are both confirmed",
             }
             : {
                 id: "repository-workflow-readiness",
                 status: "warn",
-                detail: "the review and conductor-CI workflows are not both confirmed — an unattended auto-merging run will be refused",
-                remediation: SERVER_REMEDIATIONS.repositoryWorkflowReadiness,
+                // BAPI-1360: name a confirmed-missing file separately from a file that
+                // could not be read; the remedy already differs by owner.
+                detail: readiness.review_workflow?.probe_succeeded === true &&
+                    readiness.review_workflow?.workflow_present === false
+                    ? `${REVIEW_WORKFLOW_PATH} is missing from the default branch — an unattended auto-merging run will be refused`
+                    : !gateProfileWaivesCiWorkflow(readiness) &&
+                        readiness.conductor_ci_workflow?.probe_succeeded === true &&
+                        readiness.conductor_ci_workflow?.workflow_present === false
+                        ? `${CI_WORKFLOW_PATH} is missing from the default branch — an unattended auto-merging run will be refused`
+                        : "the review and epic-implementer-ci workflows are not both confirmed — an unattended auto-merging run will be refused",
+                remediation: gateProfileAwareRepositoryWorkflowRemedy(readiness),
             },
     ];
 }
@@ -555,6 +796,15 @@ function reviewPolicyOutcome(readiness) {
     const s = readiness.supervisor;
     const alignment = s.review_policy_alignment;
     if (alignment !== null) {
+        // BAPI-1405 — `repository_policy` requires no review verdict, so a divergent
+        // done-gate review signal is not a nag. `invalid` still warns.
+        if (alignment.status === "divergent" && effectiveReviewModeIsRepositoryPolicy(readiness)) {
+            return {
+                id: "review-policy",
+                status: "pass",
+                detail: "alignment not applicable: the effective review mode is 'repository_policy', which requires no review verdict",
+            };
+        }
         if (alignment.status === "divergent" || alignment.status === "invalid") {
             return {
                 id: "review-policy",
@@ -677,6 +927,17 @@ function reconcilerOutcome(readiness) {
             remediation: SERVER_REMEDIATIONS.reconcilerUnreadable,
         };
     }
+    // BAPI-1360 — with no active run there is no progress to judge: the row is an
+    // explicit, remedy-free `skip`, not a stale-tick failure about a reconciler that
+    // has nothing to reconcile. ONLY a readable response with a strict zero count
+    // qualifies; a missing or malformed count keeps the stale/pass reading below.
+    if (r.liveness_readable === true && r.active_run_count === 0) {
+        return {
+            id: "reconciler-liveness",
+            status: "skip",
+            detail: "no active runs, so there is no run progress to check",
+        };
+    }
     if (!r.stale) {
         return {
             id: "reconciler-liveness",
@@ -726,14 +987,41 @@ function executorOutcome(readiness) {
             remediation: SERVER_REMEDIATIONS.executorStale,
         };
     }
+    // `ready === null`. BAPI-1360: with readable executor AND reconciler liveness and
+    // a strict zero active-run count, no executor being present is expected —
+    // `drive-epic` starts a run-scoped one — so it is a warning, not a failure.
+    if (readiness.reconciler.liveness_readable === true && readiness.reconciler.active_run_count === 0) {
+        return {
+            id: "executor-readiness",
+            status: "warn",
+            detail: "no executor was observed; `drive-epic` starts a run-scoped executor at launch, so a durable service is optional",
+            remediation: SERVER_REMEDIATIONS.executorNoneObservedNoRuns,
+        };
+    }
     return {
         id: "executor-readiness",
         status: "fail",
-        detail: "never observed by the server",
+        detail: "no executor was observed while runs are active or their count could not be read",
         remediation: SERVER_REMEDIATIONS.executorNeverSeen,
     };
 }
-/** Review-workflow protocol facts. `null` means an older server, not health. */
+/**
+ * BAPI-1390 — the repository-workflow remedy under the server's gate-profile
+ * rule: with a STORED gate profile the CI lane file is not required, so the
+ * remedy never names it. Without one, this is exactly
+ * {@link repositoryWorkflowRemedy}.
+ */
+export function gateProfileAwareRepositoryWorkflowRemedy(readiness) {
+    return repositoryWorkflowRemedy(gateProfileWaivesCiWorkflow(readiness) ? { ...readiness, conductor_ci_workflow: null } : readiness);
+}
+/**
+ * Review-workflow protocol facts. `null` means an older server, not health.
+ *
+ * BAPI-1390: the server now requires the review file only for a run whose review
+ * policy source is `verdict_protocol`. This repository-scoped report carries no
+ * run policy, so the row keeps its existing behavior; the per-run decision is the
+ * server's (`unattended.repository_readiness_confirmed` and admission evidence).
+ */
 function reviewWorkflowOutcome(readiness) {
     const w = readiness.review_workflow;
     if (w === null) {
@@ -754,6 +1042,16 @@ function reviewWorkflowOutcome(readiness) {
             remediation: SERVER_REMEDIATIONS.reviewWorkflowUnknown,
         };
     }
+    // BAPI-1360 — a SUCCESSFUL probe that found no file is a confirmed absence, kept
+    // apart from an unreadable file (Bridge operations) and from missing markers.
+    if (w.workflow_present === false) {
+        return {
+            id: "review-workflow",
+            status: "fail",
+            detail: `${REVIEW_WORKFLOW_PATH} is missing from the default branch (confirmed)`,
+            remediation: `a repository administrator adds ${REVIEW_WORKFLOW_PATH} to the default branch so it emits both the run id and the reviewed SHA the verdict protocol reads.`,
+        };
+    }
     if (w.emits_run_id && w.emits_reviewed_sha) {
         return {
             id: "review-workflow",
@@ -776,11 +1074,21 @@ function reviewWorkflowOutcome(readiness) {
 /** Conductor-CI migration-guard facts. `null` means an older server. */
 function ciWorkflowOutcome(readiness) {
     const c = readiness.conductor_ci_workflow;
+    // BAPI-1390 — a STORED gate profile names its own checks and migration guard,
+    // so the lane file is not required. A healthy file still reports a pass; any
+    // other state is reported as not applicable rather than as a gap.
+    if (gateProfileWaivesCiWorkflow(readiness) && !(c?.probe_succeeded === true && c.migration_guard_present === true)) {
+        return {
+            id: "conductor-ci-workflow",
+            status: "skip",
+            detail: `${CI_WORKFLOW_PATH} is not required: this repository has a stored gate profile that names its own checks`,
+        };
+    }
     if (c === null) {
         return {
             id: "conductor-ci-workflow",
             status: "fail",
-            detail: "this Bridge API deploy did not report the conductor-CI workflow facts",
+            detail: "this Bridge API deploy did not report the epic-implementer-ci workflow facts",
             remediation: SERVER_REMEDIATIONS.olderServer,
         };
     }
@@ -794,18 +1102,51 @@ function ciWorkflowOutcome(readiness) {
             remediation: SERVER_REMEDIATIONS.ciWorkflowUnknown,
         };
     }
-    return c.migration_guard_present
-        ? {
+    // BAPI-1360 — confirmed absence of the file, not a missing migration guard.
+    if (c.workflow_present === false) {
+        return {
+            id: "conductor-ci-workflow",
+            status: "fail",
+            detail: `${CI_WORKFLOW_PATH} is missing from the default branch (confirmed)`,
+            remediation: `a repository administrator adds ${CI_WORKFLOW_PATH} to the default branch. ${ciWorkflowRemedy(c)}`,
+        };
+    }
+    if (c.migration_guard_present) {
+        return {
             id: "conductor-ci-workflow",
             status: "pass",
             detail: "the default branch's conductor CI workflow runs the migration guard",
-        }
-        : {
+        };
+    }
+    // BAPI-1359 — the guard is conditional on an Alembic chain. Three explicit
+    // server answers, plus the older-server case where neither field is reported.
+    if (c.migration_chain_probe_succeeded === true && c.migration_guard_required === false) {
+        return {
             id: "conductor-ci-workflow",
-            status: "warn",
-            detail: "the conductor CI workflow does not run the migration guard",
-            remediation: SERVER_REMEDIATIONS.ciWorkflowMissingGuard,
+            status: "pass",
+            // States only what was observed. It does not say migrations are safe, or
+            // that the repository has none.
+            detail: "migration guard not required (no Alembic chain: no alembic.ini on the default branch)",
+        };
+    }
+    if (c.migration_chain_probe_succeeded === false) {
+        return {
+            id: "conductor-ci-workflow",
+            status: "fail",
+            detail: "the Alembic check could not be read, so it is not known whether the conductor CI workflow needs the migration guard",
+            remediation: ciWorkflowRemedy(c),
         };
+    }
+    return {
+        id: "conductor-ci-workflow",
+        status: "warn",
+        detail: c.migration_guard_required === true && c.migration_chain_probe_succeeded === true
+            ? "the conductor CI workflow does not run the migration guard, which this repository requires because it has alembic.ini on its default branch"
+            : // An older server (no new fields) or a partial report: keep today's
+                // wording and today's behavior, and claim nothing about alembic.ini.
+                "the conductor CI workflow does not run the migration guard",
+        remediation: ciWorkflowRemedy(c),
+    };
 }
 // ---------------------------------------------------------------------------
 // Install-time section adapter
@@ -825,6 +1166,15 @@ const INSTALL_SECTION_IDS_OWNED_ELSEWHERE = new Set([
     "supervisor-configuration",
     "supervisor-required-checks",
     "supervisor-review-alignment",
+    // BAPI-1390 — owned by `gateProfileChecks`.
+    "supervisor-gate-profile",
+    "supervisor-gate-profile-epic-branch-unseen",
+    "supervisor-gate-profile-epic-branch-search",
+    "supervisor-gate-profile-warning",
+    // BAPI-1405 — owned by `epicBranchCiChecks`.
+    EPIC_BRANCH_CI_SECTION_IDS.reviewMode,
+    EPIC_BRANCH_CI_SECTION_IDS.decision,
+    EPIC_BRANCH_CI_SECTION_IDS.coverage,
     "github-credentials",
     "github-actions-permission",
     "reconciler-liveness",
@@ -873,7 +1223,7 @@ export function mapInstallSectionsToReadinessChecks(sections) {
                 ? {}
                 : {
                     remediation: section.remediation ??
-                        "run `install conductor` for this repository to re-provision this capability.",
+                        `run \`${PRINTED_CONDUCTOR_INSTALL_COMMAND}\` for this repository to re-provision this capability. ${PRINTED_CHECK_NAME_INSTRUCTION}`,
                 }),
         }));
     }
@@ -903,13 +1253,16 @@ export async function collectConductorReadinessGate(deps) {
     }
     // A plane preflight was requested and could not be run. Not requesting one is
     // not an unavailability — its prerequisites are still reported as unknowns.
-    if (deps.runPlanePreflight && planeResult === null)
+    if (deps.runPlanePreflight && deps.planeNotApplicable === undefined && planeResult === null) {
         unavailableSources.push("plane");
+    }
     const checks = [
         ...mapInstallStatusChecksToReadinessChecks((installReport?.legacyInstallChecks ?? null), installReport === null),
         ...mapConductorDoctorReportToReadinessChecks(installReport?.legacyConductor ?? null),
         ...mapInstallSectionsToReadinessChecks(installReport?.sections ?? null),
-        ...mapPlanePreflightToReadinessChecks(planeResult),
+        ...mapPlanePreflightToReadinessChecks(planeResult, deps.planeNotApplicable, {
+            ...(deps.epicRunId !== undefined ? { epicRunId: deps.epicRunId } : {}),
+        }),
         ...mapServerReadinessToChecks(installReport?.readiness ?? null, classifyServerFailure(installReport)),
     ];
     // Validate the ASSEMBLED report, not just the pieces: an injected collector or
@@ -946,6 +1299,8 @@ async function runInstallDoctorSafely(deps) {
 }
 /** Run the plane preflight, containing any throw. */
 async function runPlaneSafely(deps) {
+    if (deps.planeNotApplicable !== undefined)
+        return null;
     if (!deps.runPlanePreflight)
         return null;
     try {