@bridge_gpt/mcp-server 0.2.67 → 0.2.69

package/build/worktree-core.js

@@ -420,6 +420,13 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
             };
         }
         const worktreePath = extractWorktreePath(result.stdout, deps.cwd, deps.platform);
+        if (behavior.postSwitch) {
+            const error = await behavior.postSwitch(worktreePath, branch);
+            if (error)
+                return { key, branch, status: "create-failed", error };
+        }
+        const resetTarget = async (target) => behavior.preReset
+            ? behavior.preReset(worktreePath, branch, target) : { ok: true, target };
         // BAPI-1367: a lineage-approved resume stops here. Retained commits and
         // uncommitted files ARE the work, so none of the destructive steps below
         // (reset, clean, base verification) may run.
@@ -431,7 +438,10 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
         // `origin/<branch>`), so this only applies when the local branch pre-existed.
         // Run inside the switched worktree (the branch is checked out there).
         if (exists && behavior.freshenFromOrigin) {
-            const resetError = await hardResetWorktree(deps, worktreePath, behavior.freshenFromOrigin);
+            const selected = await resetTarget(behavior.freshenFromOrigin);
+            if (!selected.ok)
+                return { key, branch, status: "create-failed", error: selected.error };
+            const resetError = await hardResetWorktree(deps, worktreePath, selected.target);
             if (resetError) {
                 return { key, branch, status: "create-failed", error: resetError };
             }
@@ -447,7 +457,10 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
         // branches) before this destructive reset. Absent branches were created
         // straight from `baseStartPoint`, so no alignment is needed there.
         if (exists && behavior.alignExistingBranchTo) {
-            const resetError = await hardResetWorktree(deps, worktreePath, behavior.alignExistingBranchTo);
+            const selected = await resetTarget(behavior.alignExistingBranchTo);
+            if (!selected.ok)
+                return { key, branch, status: "create-failed", error: selected.error };
+            const resetError = await hardResetWorktree(deps, worktreePath, selected.target);
             if (resetError) {
                 return { key, branch, status: "create-failed", error: resetError };
             }

package/docs/EPIC-IMPLEMENTER-INSTALL.md

@@ -211,7 +211,7 @@ checked, re-run readiness after credentials resolve.
 server: the required CI check each ticket must pass, merge approval, and the
 review policy. `drive-epic` refuses a repository without them
 (`supervisor_setup`, `supervisor_config`). With extra flags it also writes the
-`claude-review` workflow that step 6 needs, and it adds the Epic Implementer MCP
+`claude-review` workflow when you opt in to AI review, and it adds the Epic Implementer MCP
 tools to your editor config.
 
 The subcommand is still named `install conductor` (the Epic Implementer's old
@@ -222,9 +222,17 @@ and to local files. It needs a real terminal.
 
 ### 5a. Choose the required check
 
-`--required-check` is **required**. It must be the exact name of a CI check run
-that GitHub reports on child PRs into `epic/<EPIC-KEY>`. A name that never
-reports leaves every ticket waiting forever.
+The installer needs a **confirmed repository gate**: provider checks, local
+commands the executor runs, both, or none. Without gate flags it uses a gate
+already stored (an older `--required-check` setup counts), or it proposes one
+from the working tree and the provider's real check history and asks the human
+to confirm it. You may explain the proposal; you never confirm, clear, or write
+a gate. Read `docs/install/install-bridge-conductor-gate.md` first.
+
+`--required-check` is the common scripted form: it stores a confirmed provider
+gate. It must be the exact name of a CI check run that GitHub reports on child
+PRs into `epic/<EPIC-KEY>`. A name that never reports leaves every ticket
+waiting forever.
 
 - **Unattended runs (the default):** the name must be a job `name:` written
   literally in `.github/workflows/epic-implementer-ci.yml` or
@@ -247,10 +255,11 @@ a test run. The review gate reads it separately.
 ### 5b. Choose the review workflow values
 
 `.github/workflows/claude-review.yml` produces the review verdict the review
-gate waits for. For unattended runs it must also emit two markers (`run-id:`
-and `Reviewed-SHA:`). This command writes a correct file when you pass **all
-three** of these flags. If one is missing, phase 3 prints a `skipped — …` line
-and writes nothing.
+gate waits for **when you choose AI review** (`verdict_protocol`). For unattended
+runs it must also emit two markers (`run-id:` and `Reviewed-SHA:`). This command
+writes a correct file when you choose AI review and pass **all three** of these
+flags. If one is missing, phase 3 prints a `skipped — …` line and writes nothing.
+Without AI review you can skip this section.
 
 | Flag | Value |
 |---|---|
@@ -258,9 +267,17 @@ and writes nothing.
 | `--secret-name` | The **name** (not the value) of a GitHub Actions secret that holds a Claude Code OAuth token, for example `CLAUDE_CODE_OAUTH_TOKEN`. Upper-case letters, digits, and underscores only. |
 | `--branches` | The pull-request base branches to review: the default branch plus `epic/**`, for example `main,epic/**`. Child PRs target `epic/<EPIC-KEY>`, so without `epic/**` they are never reviewed. |
 
-The review policy defaults to `verdict_protocol`, which is the one that uses
-this workflow. You do not need to pass `--review-policy`. Passing it explicitly
-also stores it as the repository default.
+Installation no longer defaults to `verdict_protocol`. If you omit
+`--review-policy`, the command assumes `repository_policy`: it scaffolds **no**
+Claude-review workflow and stores **no** repository review default. A new
+feature-branch run then gets `repository_policy` from the server at its first
+approval, when neither the run nor the repository sets a policy.
+
+AI review is an explicit opt-in. Pass `--review-policy verdict_protocol` to
+scaffold the workflow and store `verdict_protocol` as the repository choice.
+Passing any value explicitly stores it as the repository default. A run that was
+already approved without a stored policy is not changed: it still resolves to
+`verdict_protocol` and still needs the workflow.
 
 If the repository already has a `claude-review.yml`, the command asks before
 overwriting it. An older or hand-written file may lack the markers. Readiness
@@ -295,7 +312,8 @@ terminal, from the repository root. It runs eight phases:
 2. A preview of the server settings, then "Write the safe project-default
    supervisor posture now?". If the change would remove an existing
    requirement, it asks a second, separate question.
-3. The `claude-review` workflow (only with the three flags from 5b).
+3. The `claude-review` workflow (only with `--review-policy verdict_protocol` and the
+   three flags from 5b).
 4. **Tool visibility:** adds `epic_implementer` to `BRIDGE_MCP_PROFILE` in the
    Bridge entry of `.mcp.json`, `.vscode/mcp.json`, and `.cursor/mcp.json`. It
    only edits files that already have a Bridge entry. It never creates a file

package/docs/EPIC-IMPLEMENTER.md

@@ -88,7 +88,7 @@ attach, and `1` for refuse or stop.
 | `--into-base` | Opt out of the epic branch; child PRs target the base branch. |
 | `--attended` | Opt out of the unattended default (see below). |
 | `--policy-file <path>` | The **complete** run policy, applied when the run is created. |
-| `--review-policy <src>` | The review policy for this run only. |
+| `--review-policy <src>` | The review policy for this run only: `repository_policy`, `verdict_protocol`, `native_review_decision`, or `none`. Omit it and the server stamps `repository_policy` at first approval for a new feature-branch run. `verdict_protocol` (AI review) is an explicit opt-in. An already-approved run with no stored policy is unchanged and still resolves to `verdict_protocol`. |
 | `--replace-policy` | Allow replacing a live run's stored policy with `--policy-file`. |
 | `--launch-profile <name>` | Use a host-local launch profile approved by `install conductor --launch-profile <name>`. `BAPI_EPIC_LAUNCH_PROFILE` selects one too; the flag wins. |
 | `--base-url <url>` | Explicit Bridge API target. It must agree with a profile. |
@@ -111,7 +111,7 @@ is created, and `drive-epic --dry-run` lists them:
 | --- | --- |
 | Repository consent | On by default. The repository owner can switch "Allow unattended Epic Implementer runs" off and on in the Bridge admin panel's Setup page. |
 | An escalation channel | A `--policy-file` that declares `notify.webhook_url`, **or** an email address on the account. `notify.local_sink` does not count. |
-| Repository readiness | `.github/workflows/claude-review.yml` and `.github/workflows/epic-implementer-ci.yml` confirmed on the default branch. The refusal names what is missing. |
+| Repository readiness | `.github/workflows/epic-implementer-ci.yml` confirmed on the default branch, plus `.github/workflows/claude-review.yml` when the run uses AI review (`verdict_protocol`). A first-approval feature-branch run with no policy set needs no review workflow. The refusal names what is missing. |
 
 **Merge-execution eligibility.** If the repository cannot perform a merge without
 a standing write credential, `setup-epic` refuses with
@@ -218,6 +218,45 @@ neither `required_checks` nor `no_ci_gate`:
    passes without CI.
 3. Otherwise nothing is stamped.
 
+**With a confirmed gate profile (BAPI-1390)** the stamp follows the profile
+instead, and always records `gate_profile_revision` and a `gate_profile_snapshot`
+that later profile edits never change:
+
+| Profile kind | Stamped when no CI key and no node checks | Auto-merge |
+|---|---|---|
+| `provider` / `mixed` | `required_checks` = the confirmed provider checks | kept (`mixed` needs both executor rollout switches on) |
+| `local` | `no_ci_gate: true`; each merge gated by executor verification of the profile's commands | kept on an epic-branch run with both switches on, else `false` (`local_gate_verification_disabled`) |
+| `none` | `no_ci_gate: true` | always `false` — every child merge waits for `merge-child` |
+
+A plan with node-level checks never gets `no_ci_gate` from the profile. An
+operator `no_ci_gate` under `provider`/`mixed` is kept; under `none` with
+auto-merge it is refused (`operator_ci_key_conflicts_with_gate`). A run-level or
+plan-level `required_checks` that drops a confirmed provider check is refused.
+
+**Gate-profile evidence bounds.** Before an unattended auto-merging run is
+admitted, every confirmed provider check must have **reported** (passing or not)
+on one of the last **12 default-branch commits** or **8 previously merged PR
+heads** from the last **90 days**, read under a fixed request budget. PRs of the
+run being admitted never count.
+
+| Admission reason | Meaning | Remedy |
+|---|---|---|
+| `provider_check_unseen` | The named check never reported in that window | Make the check report on the default branch once, or edit the gate profile |
+| `provider_evidence_unavailable` | The walk could not finish (rate limit, permission, truncation, moving head) | Retry readiness; escalate to Bridge operations if it persists |
+| `local_command_unqualified` | No current passing executor qualification for the profile's revision and command digests | Qualify the local commands, then retry |
+| `migration_guard_unset` | Root `alembic.ini` present and no confirmed member marked as the migration guard | Mark a confirmed check or command as `migration_guard` |
+
+Readiness also shows two **warn-only** rows: a confirmed check not seen on PRs
+into epic branches, and an epic-branch search that was unavailable. Neither
+changes the admission verdict.
+
+A history report proves a check **name** reported; it does **not** authenticate
+which CI produced it. The current-head green check and the executor
+verification still gate every merge, and a never-reported grandfathered check
+cannot enable auto-merge. A repository configured before profiles (legacy
+`--required-check`) keeps the two-file workflow path with no reinstall.
+Rollback: pause new auto-merge admissions and roll forward.
+
 A run left with **no** effective check and **no** `no_ci_gate` declaration does
 not pass trivially. Its tickets **park** (`required_checks_empty_no_mode`). An
 auto-merge run on the base branch with no check parks as `required_checks_empty`.
@@ -660,3 +699,30 @@ or a missing `BAPI_EPIC_IMPLEMENTER_CLI_FILE`, returns the
    API server's event loop, so the server stays responsive during a parse. A
    merged ticket enters `parsing` and moves on only after the parse succeeds. A failed parse is retried within a budget and then parks the ticket
    as `needs_human`; it never silently wedges the epic.
+
+### Local likely-test discovery
+
+Run `epic-implementer likely-tests --base <sha>` with the executor's immutable,
+full 40-character comparison commit, after committing and before the first push.
+Fallback: `npx -y -p @bridge_gpt/mcp-server epic-implementer likely-tests --base <sha>`.
+Refresh after additional commits. Map references through the repository's declared
+targeted runner; references are data, never commands.
+
+This local read-only command returns zero even on invalid input or discovery failure.
+Stdout contains only one reference per line; stderr contains fixed advisory notes.
+Recent failures come first, then explicit `.bridge/verification-hints.json` pins,
+then sorted tracked tests containing literal changed-path/import references.
+Exact duplicates are removed before the 100-reference output limit.
+
+The optional worker-worktree `.conductor/recently-failed-tests.json` is
+`{"version":1,"tests":["most-recent-first reference"],"truncated":false}`. Child 3
+owns writing it before each spawn. The shared parser keeps at most 20 references,
+each at most 512 characters, without controls or line separators. Verification hints
+use `{"version":1,"pins":[{"paths":["src/file.ts","src/package/"],"tests":["reference"]}]}`;
+file paths match exactly and directory prefixes match directory boundaries.
+
+Reads reject symlinks and traversal. Limits: 256 KiB per scanned or optional JSON
+file, 16 MiB scanned text, 10,000 sorted candidates, 10 seconds per Git subprocess,
+and 4 MiB Git output. Missing recent failures are silent. Disclose unavailable,
+malformed, unreadable, truncated, or unmappable coverage in the existing handoff.
+Retain available targeted verification; do not run a whole suite as fallback.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.67",
+  "version": "0.2.69",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -24,10 +24,10 @@
     "LICENSE"
   ],
   "//test": "The `test` script delegates to the bounded launcher (scripts/run-unit-tests.js → src/run-unit-tests-launcher.ts, BAPI-683), which discovers build/*.test.js at runtime and spawns them in size-bounded batches so the argv never exceeds Windows' ~8191-char command-line limit. Two determinism rules from the pre-launcher script are preserved INSIDE the launcher: (1) multi-file batches run WITHOUT --test-force-exit, because that flag makes node:test exit before aggregating per-subprocess summaries and the tally becomes nondeterministic (failures still surface and still set exit 1, but the count cannot be trusted as a completeness signal); (2) build/secret-safety.test.js leaks a handle that holds the event loop ~60s after its tests finish (they run in ~147ms), so the launcher quarantines it into its own single-file --test-force-exit invocation (FORCE_EXIT_QUARANTINE in src/run-unit-tests-launcher.ts) where the tally stays exact. Do NOT add --test-force-exit to batched invocations, and do NOT remove the quarantine, until the underlying handle leak is fixed.",
-  "//version": "BAPI-930: fired by `npm version <level>` AFTER npm rewrites package.json's version field, so the bumped version and the repinned README land in the SAME commit. A bump performed by hand-editing package.json instead of running `npm version` bypasses this hook entirely and must repin manually via `node scripts/sync-readme-host-examples.js` — the `--check` wired into `build` below is the backstop that catches that case.",
+  "//version": "BAPI-930: fired by `npm version <level>` AFTER npm rewrites package.json's version field, so the bumped version, repinned README and version-rendered command mirrors land in the SAME commit. A bump performed by hand-editing package.json instead of running `npm version` bypasses this hook entirely and must repin manually via `node scripts/sync-readme-host-examples.js` and `node ../commands/build.js` — the `--check` wired into `build` below is the backstop that catches that case.",
   "scripts": {
     "build": "node scripts/bundle-version.js && node scripts/sync-readme-host-examples.js --check && node scripts/validate-packaged-command-references.js && node scripts/bundle-readme.js && node scripts/bundle-pipelines.js && node scripts/bundle-commands.js && node scripts/bundle-agents.js && node scripts/bundle-docs.js && node scripts/bundle-agent-guidance.js && tsc && node scripts/sync-readme-merge-workflow.js --check && node scripts/sync-agent-mirrors.js && node scripts/bundle-esbuild.js",
-    "version": "node scripts/sync-readme-host-examples.js --write && git add -- README.md package.json package-lock.json && git commit -m \"chore(mcp-server): release $npm_package_version\" && git tag \"mcp-server/v$npm_package_version\"",
+    "version": "node scripts/sync-readme-host-examples.js --write && node ../commands/build.js && git add -- ../.claude/commands ../.cursor/commands .claude/commands && git add -- README.md package.json package-lock.json && git commit -m \"chore(mcp-server): release $npm_package_version\" && git tag \"mcp-server/v$npm_package_version\"",
     "check:version-generated": "node scripts/bundle-version.js && node scripts/check-version-generated.js",
     "assert:release-identity": "node scripts/assert-release-identity.js",
     "postbuild": "node scripts/prepend-shebang.cjs",

package/pipelines/greenfield-setup.json

@@ -147,134 +147,10 @@
       "description": "Draft the project standards from the committed framing and take one approval"
     },
     {
-      "type": "mcp_call",
-      "id": "upload_architecture_instructions",
-      "tool": "config_field",
-      "params": {
-        "field_name": "architecture_instructions",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/architecture_instructions.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the architecture standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_review_instructions",
-      "tool": "config_field",
-      "params": {
-        "field_name": "review_instructions",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/review_instructions.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the code-review standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_documentation_instructions",
-      "tool": "config_field",
-      "params": {
-        "field_name": "documentation_instructions",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/documentation_instructions.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the documentation standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_unit_testing_instructions",
-      "tool": "config_field",
-      "params": {
-        "field_name": "unit_testing_instructions",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/unit_testing_instructions.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the unit-testing standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_e2e_testing_instructions",
-      "tool": "config_field",
-      "params": {
-        "field_name": "e2e_testing_instructions",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/e2e_testing_instructions.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the end-to-end testing standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_frontend_correctness_standards",
-      "tool": "config_field",
-      "params": {
-        "field_name": "frontend_correctness_standards",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/frontend_correctness_standards.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the frontend correctness standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_backend_correctness_standards",
-      "tool": "config_field",
-      "params": {
-        "field_name": "backend_correctness_standards",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/backend_correctness_standards.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the backend correctness standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_template_correctness_standards",
-      "tool": "config_field",
-      "params": {
-        "field_name": "template_correctness_standards",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/template_correctness_standards.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the template correctness standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_style_correctness_standards",
-      "tool": "config_field",
-      "params": {
-        "field_name": "style_correctness_standards",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/style_correctness_standards.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the style correctness standard",
-      "on_error": "warn_and_continue"
-    },
-    {
-      "type": "mcp_call",
-      "id": "upload_design_principles",
-      "tool": "config_field",
-      "params": {
-        "field_name": "design_principles",
-        "file_path": "{docs_dir}/greenfield/{repo_name}/standards/design_principles.md",
-        "operation": "update",
-        "only_if_null": true
-      },
-      "description": "Save the design principles",
-      "on_error": "warn_and_continue"
+      "type": "agent_task",
+      "id": "upload_approved_standards",
+      "instruction_file": "greenfield-upload-approved-standards.md",
+      "description": "Upload only standards explicitly approved in the current synthesis result and report partial failures"
     },
     {
       "type": "agent_task",

package/pipelines/implement-ticket.json

@@ -1,7 +1,7 @@
 {
   "name": "implement-ticket",
   "description": "Initial feature workflow: generate a plan, produce artifacts, checkpoint to origin, verify, commit, open a PR, close post-PR gaps, and monitor CI. Re-entry of this initial workflow may reuse a fresh plan, but remaining-work corrections and continuations use versioned focused intent on the retained branch and never re-enter this recipe.",
-  "variables": ["ticket_key", "docs_dir", "provider"],
+  "variables": ["ticket_key", "docs_dir", "provider", "verification_scope"],
   "steps": [
     {
       "type": "mcp_call",
@@ -23,7 +23,7 @@
     {
       "type": "agent_task",
       "instruction_file": "execute-plan.md",
-      "description": "Produce the plan's implementation artifacts"
+      "description": "Produce the plan's implementation artifacts. Under the Epic Implementer, a minor requirement that cannot be met unattended gets a guarded workaround plus a record at .bridge/epic-workarounds/<TICKET>.md, committed on the ticket branch with git add -f; a core requirement is never worked around and is left unfinished so the run parks the ticket."
     },
     {
       "type": "agent_task",
@@ -69,6 +69,7 @@
       "on_error": "warn_and_continue"
     },
     {
+      "id": "monitor-ci-checks",
       "type": "agent_task",
       "instruction_file": "monitor-ci-checks.md",
       "description": "Monitor CI checks and report results"