@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/install-bridge-conductor.js

@@ -106,6 +106,8 @@
  * The command does NOT persist a repository-level review policy: that is
  * BAPI-694's. The policy selected here is per-run and is reported as such.
  */
+import { PRINTED_INSTALL_COMMAND, PRINTED_QUALIFY_GATE_COMMAND } from "./printed-remedy-commands.js";
+import { emptyConductorGateFlags, hasExplicitGateInput, parseLocalCommandFlag, parseEpicBranchCiDecisionFlag, parseMigrationGuardFlag, resolveConductorGate, runEpicBranchCiInspection, runClearConductorGate, runConductorGateQualification, runQualifyConductorGate, storeConductorGate, validateConductorGateFlags, } from "./install-bridge-conductor-gate.js";
 import { bootstrapConductorSupervisorDefaults, classifySupervisorBootstrapFailure, fetchConductorReadiness, previewConductorSupervisorBootstrap, } from "./conductor/bridge-api-client.js";
 import { CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, conductorInstallDoctorExitCode, conductorInstallDoctorHasFatal, formatConductorInstallDoctorReport, } from "./conductor/install-doctor.js";
 import { describeNativeLedgerAvailability, } from "./conductor/doctor.js";
@@ -130,28 +132,76 @@ export const CONDUCTOR_REVIEW_POLICY_SOURCES = [
     "verdict_protocol",
     "native_review_decision",
     "none",
+    "repository_policy",
 ];
-/** Default per-run review policy when the operator does not select one. */
-export const DEFAULT_CONDUCTOR_REVIEW_POLICY = "verdict_protocol";
+/**
+ * Install-time review policy when the operator does not select one (BAPI-1406).
+ *
+ * `repository_policy` needs no Claude-review workflow, so an omitted flag
+ * scaffolds none. It is an install-time assumption ONLY: nothing persists it.
+ * {@link InstallBridgeConductorOptions.reviewPolicyExplicit} stays the sole basis
+ * for storing a repository default, and the server stamps the run-level default
+ * at first approval. AI review is an explicit `--review-policy verdict_protocol`.
+ */
+export const DEFAULT_CONDUCTOR_REVIEW_POLICY = "repository_policy";
 /** Usage text for `install-bridge conductor`. */
 export function getInstallBridgeConductorUsage() {
     return [
         "Usage: install conductor [options]",
         "",
-        "Bootstrap Epic Conductor v2 for this repository: run the unified read-only",
+        "Bootstrap the Epic Implementer for this repository: run the unified read-only",
         "doctor, write the safe project-default supervisor posture, optionally scaffold",
         "the claude-review workflow, report the capability matrix, and re-run the doctor.",
         "",
         "Options:",
         "  --repo <name>              Repository name (default: BAPI_REPO_NAME / .bridge/config)",
-        "  --required-check <name>    Required CI check for the done gate (repeatable, REQUIRED)",
+        "  --required-check <name>    A provider check for the gate (repeatable). Explicit",
+        "                             owner input: stored as a confirmed provider gate and",
+        "                             projected into the done gate, as before.",
         "  --required-checks a,b      Comma-separated form of --required-check",
+        "",
+        "Repository gate (BAPI-1391) — what must pass before a child merges. A CONFIRMED",
+        "gate is required: provider checks, local commands, both (mixed), or none.",
+        "Without gate flags, a confirmed gate already stored (including an older",
+        "--required-check setup) is used unchanged; otherwise discovery reads this",
+        "working tree and the provider's real check history and PROPOSES a gate, which",
+        "is stored only after you confirm or edit it at a prompt. Discovery saves",
+        "nothing. Explicit gate flags are owner input and are stored as confirmed.",
+        "  --provider-check <name>    An exact provider-reported check name (repeatable).",
+        "                             Admission refuses one that has never reported.",
+        "  --local-command <cmd>      A local command the executor runs before each merge",
+        "                             (repeatable): a discovered candidate id such as",
+        "                             npm:test, or <name>=<plain words> such as",
+        "                             unit=pytest -q (no shell syntax; run without a shell).",
+        "  --migration-guard <ref>    provider:<check> or local:<command>: the member that",
+        "                             guards Alembic migrations.",
+        "  --gate-none                No gate: unattended runs need approval for every",
+        "                             child merge. Exclusive with the member flags.",
+        "  --customized-command <n>   A packaged command this repository customizes, stored",
+        "                             in the confirmed gate (repeatable), e.g. implement-ticket.",
+        "  --confirm-gate             Confirm explicit gate flags even when they REMOVE",
+        "                             members from the stored gate (otherwise you are asked).",
+        "  --clear-gate               Clear the confirmed gate (its own consent), then exit.",
+        "  --qualify-gate             Qualify a confirmed local or mixed gate: queue the",
+        "                             qualification job and drain it with a short-lived",
+        "                             repository-wide executor limited to that job type.",
+        "                             Alone, it does only that; with gate flags it runs",
+        "                             after they are stored, without the offer prompt.",
+        "  Every gate write first checks that the server advertises gate_profile.v1;",
+        "  against an older server it prints \"Bridge API update required\" and exits 1.",
+        "",
         `  --review-policy <source>   One of: ${CONDUCTOR_REVIEW_POLICY_SOURCES.join(", ")}`,
-        `                             (default: ${DEFAULT_CONDUCTOR_REVIEW_POLICY}). Supplying it`,
-        "                             EXPLICITLY also persists it as the supervisor",
-        "                             project default, stamped into a new run that",
-        "                             carries no review policy of its own. Omitting it",
-        "                             stores no default at all.",
+        "                             Omitted, install assumes repository_policy: the",
+        "                             prospective default for a new feature-branch run at",
+        "                             first approval when neither the run nor the",
+        "                             repository sets a policy. It scaffolds no Claude",
+        "                             review workflow and stores no default at all.",
+        "                             AI review is an explicit opt-in: pass",
+        "                             --review-policy verdict_protocol to scaffold the",
+        "                             workflow. Supplying any value EXPLICITLY also",
+        "                             persists it as the supervisor project default,",
+        "                             stamped into a new run that carries no review",
+        "                             policy of its own.",
         "  --epic-key <KEY>           Epic key for the setup-epic verification phase",
         "  --plan-file <path>         Plan sidecar for the setup-epic verification phase",
         "  --executor-id <id>         Stable executor id. Supplying it OPTS IN to the",
@@ -183,9 +233,10 @@ export function getInstallBridgeConductorUsage() {
         "                             approves one named server and has no default.",
         "  --execution-mode <mode>    local | durable (default: durable with",
         "                             --executor-id, otherwise local).",
-        "  --policy-file <path>       Run policy the profile references; an unattended",
-        "                             run needs notify.webhook_url reachable from the",
-        "                             API server (notify.local_sink is not enough).",
+        "  --policy-file <path>       Run policy the profile references. An unattended",
+        "                             run escalates to a notify.webhook_url reachable",
+        "                             from the API server or, with none declared, to the",
+        "                             account's email (notify.local_sink is not enough).",
         "  --dry-run                  Diagnose and preview only. Performs NO writes:",
         "                             no POST, no file write, no host MCP config write,",
         "                             no Git hook write, no install-state or capability",
@@ -194,6 +245,11 @@ export function getInstallBridgeConductorUsage() {
         "                             start-consent prompt.",
         "                             Still asks the base-URL confirmation below first —",
         "                             its doctor readiness GET carries the repo API key.",
+        "  --epic-branch-ci-decision <include|decline>",
+        "                             (BAPI-1405, GitHub only) Record whether child merges",
+        "                             into an epic branch wait for CI on that PR. Without",
+        "                             it you are asked; a non-interactive run records",
+        "                             nothing. Never consent to change an approval rule.",
         "  -h, --help                 Show this help",
         "",
         "The resolved BAPI_BASE_URL is displayed and confirmed BEFORE any network call",
@@ -208,7 +264,7 @@ export function getInstallBridgeConductorUsage() {
         "nor changed. No file is ever created: when no supported config carries a",
         "a Bridge entry, the run says so and points at the base `install` command.",
         "The MCP server captures its active groups at startup, so a merge activates on",
-        "the next launch — restart your MCP client to see the conductor tools.",
+        "the next launch — restart your MCP client to see the Epic Implementer tools.",
         "",
         "Local observability (a SEPARATE consent): installs or updates this",
         "repository's managed conductor Git hooks (post-commit,",
@@ -281,10 +337,12 @@ export function parseInstallBridgeConductorArgs(argv) {
     let secretName;
     let branches;
     const requiredChecks = [];
+    const gate = emptyConductorGateFlags();
     let launchProfile;
     let baseUrl;
     let executionMode;
     let policyFile;
+    let epicBranchCiDecision;
     const takeValue = (arg, inline, next) => {
         if (inline !== undefined) {
             if (inline.trim().length === 0)
@@ -322,6 +380,21 @@ export function parseInstallBridgeConductorArgs(argv) {
                     return { status: "error", message: "--repo-wide takes no value" };
                 repoWide = true;
                 break;
+            case "--gate-none":
+            case "--confirm-gate":
+            case "--clear-gate":
+            case "--qualify-gate":
+                if (inline !== undefined)
+                    return { status: "error", message: `${flag} takes no value` };
+                if (flag === "--gate-none")
+                    gate.gateNone = true;
+                else if (flag === "--confirm-gate")
+                    gate.confirmGate = true;
+                else if (flag === "--clear-gate")
+                    gate.clearGate = true;
+                else
+                    gate.qualifyGate = true;
+                break;
             case "--repo":
             case "--required-check":
             case "--required-checks":
@@ -336,7 +409,12 @@ export function parseInstallBridgeConductorArgs(argv) {
             case "--launch-profile":
             case "--base-url":
             case "--execution-mode":
-            case "--policy-file": {
+            case "--policy-file":
+            case "--provider-check":
+            case "--local-command":
+            case "--migration-guard":
+            case "--customized-command":
+            case "--epic-branch-ci-decision": {
                 const taken = takeValue(flag, inline, argv[i + 1]);
                 if (!taken.ok)
                     return { status: "error", message: taken.error };
@@ -345,8 +423,35 @@ export function parseInstallBridgeConductorArgs(argv) {
                 const value = taken.value;
                 if (flag === "--repo")
                     repo = value;
-                else if (flag === "--required-check")
+                else if (flag === "--required-check" || flag === "--provider-check")
                     requiredChecks.push(value);
+                else if (flag === "--local-command") {
+                    const local = parseLocalCommandFlag(value);
+                    if (!local.ok)
+                        return { status: "error", message: local.error };
+                    gate.localCommands.push(local.value);
+                }
+                else if (flag === "--migration-guard") {
+                    if (gate.migrationGuard !== undefined) {
+                        return { status: "error", message: "--migration-guard may be given once" };
+                    }
+                    const guard = parseMigrationGuardFlag(value);
+                    if (!guard.ok)
+                        return { status: "error", message: guard.error };
+                    gate.migrationGuard = guard.value;
+                }
+                else if (flag === "--epic-branch-ci-decision") {
+                    if (epicBranchCiDecision !== undefined) {
+                        return { status: "error", message: "--epic-branch-ci-decision may be given once" };
+                    }
+                    const decision = parseEpicBranchCiDecisionFlag(value);
+                    if (!decision.ok)
+                        return { status: "error", message: decision.error };
+                    epicBranchCiDecision = decision.value;
+                }
+                else if (flag === "--customized-command") {
+                    gate.customizedCommands = [...(gate.customizedCommands ?? []), value];
+                }
                 else if (flag === "--required-checks")
                     requiredChecks.push(...splitList(value));
                 else if (flag === "--epic-key")
@@ -405,9 +510,12 @@ export function parseInstallBridgeConductorArgs(argv) {
                 return { status: "error", message: `Unknown option: ${flag}` };
         }
     }
-    // Normalize + validate the required-check list at parse time so a bad list can
-    // never reach the bootstrap request. An EMPTY done gate is not a weaker gate —
-    // it passes unconditionally — so it is rejected here, not merely defaulted.
+    // Normalize + validate the provider-check list at parse time so a bad list can
+    // never reach a request. BAPI-1391 replaced "at least one --required-check" with
+    // "a confirmed gate": a stored gate, a confirmed proposal, or explicit gate
+    // flags — and a confirmed local-only or `none` gate is valid. An empty CI list
+    // is still never written as a passing gate: the server accepts one only for a
+    // stored local or none gate, and the run stops without a confirmed gate.
     const normalizedChecks = [];
     const seen = new Set();
     for (const check of requiredChecks) {
@@ -417,13 +525,10 @@ export function parseInstallBridgeConductorArgs(argv) {
         seen.add(check);
         normalizedChecks.push(check);
     }
-    if (normalizedChecks.length === 0) {
-        return {
-            status: "error",
-            message: "At least one --required-check is required. An empty done gate passes unconditionally, " +
-                "so the bootstrap refuses to write one.",
-        };
-    }
+    gate.providerChecks = normalizedChecks;
+    const gateError = validateConductorGateFlags(gate, { replaceDoneGate });
+    if (gateError !== null)
+        return { status: "error", message: gateError };
     // BAPI-1137 — the claim scope is validated HERE, at parse time, for the same
     // reason the required-check list is: a unit that cannot start is worse than a
     // refused invocation, and discovering it costs a reboot to notice.
@@ -485,6 +590,7 @@ export function parseInstallBridgeConductorArgs(argv) {
             repo,
             dryRun,
             requiredChecks: normalizedChecks,
+            gate,
             reviewPolicy,
             reviewPolicyExplicit,
             epicKey,
@@ -503,6 +609,7 @@ export function parseInstallBridgeConductorArgs(argv) {
                 ? { executionMode: executionMode ?? (executorId !== undefined ? "durable" : "local") }
                 : {}),
             ...(policyFile ? { policyFile } : {}),
+            ...(epicBranchCiDecision ? { epicBranchCiDecision } : {}),
         },
     };
 }
@@ -688,12 +795,21 @@ async function confirm(deps, promptText) {
 }
 function renderCapabilityMatrix(deps, readiness) {
     const apiReady = readiness !== null;
+    // BAPI-1391 — a CONFIRMED local-only or `none` gate has no CI checks by
+    // design: its gate is the profile (executor-run commands, or approval for
+    // every merge), so an empty CI list is not "unconfigured" there. Read from
+    // the server's own confirmed-profile state; an older server reports no
+    // `gate_profile` block and keeps the original rule exactly.
+    const gateProfile = readiness?.gate_profile ?? null;
+    const confirmedCiFreeGate = gateProfile !== null &&
+        gateProfile.confirmed === true &&
+        (gateProfile.kind === "local" || gateProfile.kind === "none");
     // Derived from READINESS, never from the bootstrap's HTTP status: a 200 proves
     // the write was accepted, not that the resulting posture is safe.
     const configurationReady = readiness !== null &&
         readiness.supervisor.setup_present &&
         readiness.supervisor.config_present &&
-        !readiness.supervisor.required_checks_empty;
+        (!readiness.supervisor.required_checks_empty || confirmedCiFreeGate);
     // `ready === null` (never provisioned) and `false` (stale) are both "not ready"
     // here, but only a recent server-observed claim/heartbeat counts as ready — a
     // configured command or a local process does not.
@@ -704,6 +820,14 @@ function renderCapabilityMatrix(deps, readiness) {
     deps.log(`  api_ready:            ${apiReady}`);
     deps.log(`  configuration_ready:  ${configurationReady}`);
     deps.log(`  executor_ready:       ${executorReady}`);
+    if (gateProfile !== null) {
+        // Names nothing: the kind, provenance, revision, and qualification state only.
+        deps.log(`  repository gate:      ${gateProfile.confirmed ? (gateProfile.kind ?? "unknown") : "not confirmed"}` +
+            (gateProfile.confirmed ? ` (${gateProfile.source}, revision ${gateProfile.revision}` +
+                (gateProfile.qualification_state && gateProfile.qualification_state !== "not_required"
+                    ? `, local gate ${gateProfile.qualification_state})`
+                    : ")") : ""));
+    }
     deps.log(`  executor provisioning: ${EXECUTOR_PROVISIONING_GUIDANCE}`);
     deps.log(`  runbook:              ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}`);
     return { apiReady, configurationReady, executorReady };
@@ -939,7 +1063,7 @@ export function formatConductorRestartAdvisory(mergedProfile) {
         "client to gain access to the Epic Implementer tools.");
 }
 /** Remediation printed when no supported host config carries a Bridge entry. */
-export const CONDUCTOR_PROFILE_EMPTY_MERGE_REMEDIATION = `run \`npx ${MCP_PACKAGE_NAME} install\` to create and register the host MCP entry, ` +
+export const CONDUCTOR_PROFILE_EMPTY_MERGE_REMEDIATION = `run \`${PRINTED_INSTALL_COMMAND}\` to create and register the host MCP entry, ` +
     "then re-run `install conductor`.";
 /** Remediation printed whenever the managed conductor hooks were not installed. */
 export const CONDUCTOR_HOOKS_MANUAL_REMEDIATION = "re-run `install conductor` and accept the local-observability consent, or run " +
@@ -1503,6 +1627,27 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     const accessResult = await deps.resolveAccess(options.repo, baseUrl);
     const access = accessResult.ok ? accessResult.access : null;
     const accessError = accessResult.ok ? undefined : accessResult.error;
+    // ---- BAPI-1391: the two standalone gate actions -----------------------
+    // `--clear-gate`, and `--qualify-gate` without gate flags, act on the stored
+    // gate and stop: they never bootstrap, scaffold, or provision anything else.
+    const gateIo = {
+        log: deps.log,
+        errorLog: deps.errorLog,
+        promptLine: deps.promptLine,
+        fetchJson: deps.fetchJson,
+        postJson: deps.postJson,
+    };
+    const qualifyOnly = options.gate.qualifyGate && !hasExplicitGateInput(options.gate);
+    if (options.gate.clearGate || qualifyOnly) {
+        if (!access) {
+            deps.errorLog(`Bridge API access could not be resolved: ${accessError ?? "unknown"}`);
+            deps.errorLog("Nothing was written.");
+            return 1;
+        }
+        return options.gate.clearGate
+            ? runClearConductorGate(gateIo, access, { dryRun: options.dryRun })
+            : runQualifyConductorGate(gateIo, access, deps.gate, { dryRun: options.dryRun, baseUrl });
+    }
     // ---- Phase 1: unified doctor, BEFORE every write -----------------------
     deps.log("Phase 1/8 — running the unified epic-implementer doctor (read-only)…");
     const firstReport = await deps.runDoctor({
@@ -1525,8 +1670,10 @@ export async function runInstallBridgeConductorCli(argv, deps) {
             "default and stamped into a new run that sets no review policy of its own. " +
             "An explicit per-run policy always wins, and changing this later never " +
             "alters an already-approved run."
-        : "  Applied to runs created with this selection. No repository default is " +
-            "persisted — pass --review-policy explicitly to store one.");
+        : "  Install assumption only: no repository default is persisted and no " +
+            "Claude review workflow is scaffolded. A new feature-branch run receives " +
+            "repository_policy at first approval when nothing else sets one — pass " +
+            "--review-policy verdict_protocol to opt in to AI review.");
     // ---- Executor preflight: AFTER the URL consent, BEFORE any mutation ----
     // Placed here so an unsupported host or a missing `wt`/`git`/`claude` refuses
     // before the bootstrap POST, the workflow write, or a single filesystem
@@ -1575,15 +1722,52 @@ export async function runInstallBridgeConductorCli(argv, deps) {
         deps.log("  executor provisioning skipped — pass --executor-id <id> to write and start a " +
             "service unit for this host.");
     }
+    // ---- BAPI-1391: the repository gate, decided BEFORE any write ----------
+    // Capability probe first (a read, after the base-URL consent), then the stored
+    // gate, explicit gate flags, or a discovery proposal the owner confirms. Under
+    // --dry-run it only shows the decision: no PUT, no enqueue, no gate prompt.
+    if (!access) {
+        deps.errorLog("Bridge API access could not be resolved; aborting before any write.");
+        return 1;
+    }
+    const gatePhase = await resolveConductorGate(gateIo, access, options.gate, deps.gate, {
+        dryRun: options.dryRun,
+    });
+    if (gatePhase.kind === "exit")
+        return gatePhase.code;
+    const gatePlan = gatePhase.kind === "plan" ? gatePhase.plan : null;
+    // The bootstrap's CI list is the gate's provider leg. A local-only or `none`
+    // gate sends an empty list, which the server accepts only for a stored gate
+    // of that kind.
+    const bootstrapChecks = gatePlan?.desired.providerChecks ?? options.requiredChecks;
     // ---- Dry run: preview and RETURN before every write/prompt -------------
     if (options.dryRun) {
         deps.log("");
         deps.log("Dry run — no writes will be performed.");
+        if (gatePlan === null) {
+            deps.log("  Repository gate: none confirmed — a real run asks you to confirm one before any write.");
+        }
+        else if (gatePlan.write !== null) {
+            // Field NAMES and counts only, as below.
+            deps.log(`  Would PUT /jira/epic-runs/supervisor-setup/gate-profile/ (confirm, expected revision ` +
+                `${gatePlan.write.expected_revision}) with field NAMES: kind, ` +
+                `provider_checks (${gatePlan.desired.providerChecks.length}), ` +
+                `local_commands (${gatePlan.desired.localCommands.length}), migration_guard` +
+                (gatePlan.write.customized_commands !== undefined ? ", customized_commands" : ""));
+        }
+        else {
+            deps.log("  Repository gate: already confirmed as shown — no gate write.");
+        }
+        if (gatePlan !== null && gatePlan.desired.localCommands.length > 0) {
+            deps.log("  Gate qualification: would be offered after the gate is stored — no job was queued.");
+        }
+        deps.log("  Epic-branch CI: a real run inspects workflow triggers and epic-branch rules (GitHub only), " +
+            "then asks include or decline — nothing was inspected or recorded.");
         deps.log("  Would PREVIEW, then POST /jira/epic-runs/supervisor-bootstrap with field NAMES:");
         // Field NAMES and a COUNT only — never the check values, which are
         // configuration content, and never the API key.
         deps.log("    - done_gate_config.required_checks " +
-            `(${options.requiredChecks.length} check(s))`);
+            `(${bootstrapChecks.length} check(s))`);
         if (options.reviewPolicyExplicit)
             deps.log("    - review_policy");
         if (options.replaceDoneGate)
@@ -1634,10 +1818,10 @@ export async function runInstallBridgeConductorCli(argv, deps) {
         deps.log("complete-with-manual-steps (dry run)");
         return 0;
     }
-    if (!access) {
-        // Unreachable in practice (a null access produces a fatal doctor section
-        // above), but the type must be narrowed before the preview.
-        deps.errorLog("Bridge API access could not be resolved; aborting before the write.");
+    if (gatePlan === null) {
+        // Unreachable outside a dry run: the gate phase either decided a gate or
+        // returned. Narrowed here so the bootstrap below always has one.
+        deps.errorLog("No confirmed repository gate; aborting before any write.");
         return 1;
     }
     // ---- Phase 2: bootstrap — preview, consent, exact approval, apply -------
@@ -1648,7 +1832,7 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     deps.log("");
     deps.log("Phase 2/8 — bootstrapping supervisor project defaults…");
     const bootstrapRequest = {
-        required_checks: options.requiredChecks,
+        required_checks: bootstrapChecks,
         // BAPI-694 — the narrow ReviewPolicy object, sent ONLY on an explicit
         // selection. `review_source` is deliberately NOT sent: on an existing
         // repository an omitted field keeps its stored value, and a new repository
@@ -1659,6 +1843,32 @@ export async function runInstallBridgeConductorCli(argv, deps) {
         merge_approval_required: "true",
         ...(options.replaceDoneGate ? { replace_done_gate: true } : {}),
     };
+    // BAPI-1391 — the gate is stored FIRST, under its own combined consent, in
+    // two cases:
+    //  * a gate with no provider checks (local-only or `none`): the server
+    //    accepts an empty CI list only for a stored gate of that kind;
+    //  * any change to an already STORED gate: the bootstrap apply would
+    //    otherwise run BAPI-1390's profile sync first, which merges the additive
+    //    CI list into the stored profile under a new revision — so a later PUT
+    //    would be refused as stale while the gate had silently been widened.
+    //    Stored first, the CI checks already equal the gate, the bootstrap adds
+    //    nothing, and the sync has nothing to change.
+    // A legacy or unconfirmed repository keeps the original order (preview,
+    // consent, apply) and is stored after the apply; the sync never touches it.
+    const gateFirst = gatePlan.write !== null &&
+        (bootstrapChecks.length === 0 || gatePlan.current.source === "stored");
+    let storedGate = gatePlan.write === null ? gatePlan.current : null;
+    if (gateFirst) {
+        deps.log("");
+        const gateOk = await confirm(deps, "Store this repository gate and write the safe project-default supervisor posture now? [y/N]: ");
+        if (!gateOk) {
+            deps.log("Aborted — no server write was attempted.");
+            return 0;
+        }
+        storedGate = await storeConductorGate(gateIo, access, gatePlan);
+        if (storedGate === null)
+            return 1;
+    }
     let preview;
     try {
         preview = await previewConductorSupervisorBootstrap(access, bootstrapRequest, deps.postJson);
@@ -1671,11 +1881,14 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     // ---- Consent #2: the bootstrap write itself ----------------------------
     // Deliberately separate from the base-URL consent above (which was given
     // before any network call). Confirming WHERE to write is not consent TO write.
-    deps.log("");
-    const bootstrapOk = await confirm(deps, "Write the safe project-default supervisor posture now? [y/N]: ");
-    if (!bootstrapOk) {
-        deps.log("Aborted — no server write was attempted.");
-        return 0;
+    // A gate stored first above was stored under its own combined consent.
+    if (!gateFirst) {
+        deps.log("");
+        const bootstrapOk = await confirm(deps, "Write the safe project-default supervisor posture now? [y/N]: ");
+        if (!bootstrapOk) {
+            deps.log("Aborted — no server write was attempted.");
+            return 0;
+        }
     }
     // ---- Consent #3: the EXACT gate change, only when the preview needs it ---
     // Never inferred from consent #2: agreeing to install is not agreeing to
@@ -1707,6 +1920,49 @@ export async function runInstallBridgeConductorCli(argv, deps) {
         return 1;
     }
     renderBootstrapOutcome(deps, bootstrapResponse);
+    // ---- BAPI-1391: store the confirmed gate, then offer its qualification --
+    // Stored after the apply so the bootstrap's additive CI write cannot widen
+    // the gate's exact provider checks: the gate PUT rewrites that projection to
+    // exactly the confirmed checks, under the server's revision compare-and-swap.
+    if (storedGate === null) {
+        storedGate = await storeConductorGate(gateIo, access, gatePlan);
+        if (storedGate === null)
+            return 1;
+    }
+    const manualActions = [];
+    if (gatePlan.desired.localCommands.length > 0) {
+        const qualified = storedGate.qualification_state === "qualified";
+        let qualify = options.gate.qualifyGate;
+        if (!qualify && !qualified) {
+            deps.log("");
+            deps.log("  The local gate must pass once under the executor before an unattended run is admitted.");
+            qualify = await confirm(deps, "Qualify gate now? [y/N]: ");
+        }
+        if (qualify) {
+            // Non-fatal by design: a failed qualification warns and the install goes on.
+            await runConductorGateQualification(gateIo, access, deps.gate, {
+                revision: storedGate.revision,
+                baseUrl,
+            });
+        }
+        else if (!qualified) {
+            manualActions.push(`gate qualification: run ${PRINTED_QUALIFY_GATE_COMMAND} to qualify the local gate; ` +
+                "until then admission refuses it (local_command_unqualified).");
+        }
+        else {
+            deps.log(`  local gate already qualified at revision ${storedGate.revision}.`);
+        }
+    }
+    // ---- BAPI-1405: epic-branch CI inspection and the explicit decision ----
+    // Runs after the gate is resolved and stored, inside the gate phase. It only
+    // reports and proposes; it never confirms a gate or authorizes a merge. A
+    // failed read or decision write warns and the install continues.
+    const epicBranchCi = await runEpicBranchCiInspection(gateIo, access, deps.gate, {
+        decisionFlag: options.epicBranchCiDecision ?? null,
+        dryRun: false,
+    });
+    if (epicBranchCi.manualAction !== null)
+        manualActions.push(epicBranchCi.manualAction);
     // ---- Phase 3: optional workflow scaffold -------------------------------
     deps.log("");
     deps.log("Phase 3/8 — claude-review workflow…");
@@ -1770,7 +2026,6 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     // Placed after the workflow scaffold and BEFORE setup-epic verification,
     // executor provisioning, and the capability report, so a run that stops at a
     // later phase has still closed the local gap it consented to close.
-    const manualActions = [];
     deps.log("");
     deps.log("Phase 4/8 — conductor tool visibility…");
     if (local) {